If you discover a security issue, report it privately to raisaac@icloud.com.

Include:

• a short description of the issue
• affected package or command
• reproduction steps if available
• expected and actual behavior

Do not open a public issue for vulnerabilities that could expose users, credentials, or systems before a fix is available.