Please do not report security vulnerabilities through public issues.

For a public repository, open its Security tab and select Report a vulnerability. Include the affected package and version, reproduction steps, impact, and any suggested mitigation. We will acknowledge the report and coordinate disclosure through the private advisory.

If private vulnerability reporting is unavailable, use the repository's documented maintainer contact instead of disclosing sensitive details publicly.