Please do not disclose suspected vulnerabilities in a public issue.

Use GitHub's Report a vulnerability button on the repository's Security page. Include the affected version, reproduction steps, impact, and any suggested mitigation. Reports will be acknowledged as soon as practical and handled privately while the issue is investigated.

If the report includes credentials or other sensitive data, revoke or rotate them before submitting the report. Never include live secrets in an issue, pull request, test fixture, or log.

Security fixes are made against the latest release and the default branch. Users should upgrade to the newest available version.