If you discover a security issue, report it privately to raisaac@icloud.com.
Include:
- a short description of the issue
- affected package or command
- reproduction steps if available
- expected and actual behavior
Do not open a public issue for vulnerabilities that could expose users, credentials, or systems before a fix is available.