Report security vulnerabilities privately via GitHub's private vulnerability reporting (the "Report a vulnerability" button / a Security Advisory). Do not open a public issue for security concerns. Note that this is a personal account and I may not be able to review every report.

Please include the affected commit or version, clear reproduction steps, and a short impact summary. Logs or a minimal proof of concept are helpful but optional.

I may acknowledge reports when I can. I prefer coordinated disclosure. If you plan to publish details please give reasonable time to address the issue.