If you find a security vulnerability, please report it responsibly.

Do not open a public issue for security-sensitive bugs.

• Open a private GitHub Security Advisory.
• Include steps to reproduce and impact if you can.
• We'll respond and work on a fix; we may credit you after the fix is released unless you prefer to stay anonymous.

Thank you.