Please do not open a public issue for security-sensitive reports.

• Preferred: Use GitHub Security Advisories for this repository (replace the owner/name in the URL if your fork differs).
• Alternative: Contact the maintainers with enough detail to reproduce the issue and, if possible, suggested impact; allow reasonable time for a fix before public disclosure.

We will acknowledge receipt and work on a remediation plan. Update the repository URL above if you publish under a different GitHub path.