Please do not open public issues for suspected vulnerabilities. Use GitHub private vulnerability reporting to contact the repository maintainer privately.

Include affected version/commit, reproduction steps, impact, and any suggested mitigation. Do not include live credentials, private keys, or sensitive customer data. We will acknowledge reports, investigate, and coordinate a disclosure timeline.