Report vulnerabilities privately through GitHub Security Advisories rather than a public issue. Include affected versions, impact, and a minimal reproduction when possible.

Security fixes are made for the latest released version. The type-level APIs reduce accidental misuse; they are not a sandbox against reflection, emitted IL, Unchecked.defaultof, or other hostile .NET code.