Please report suspected vulnerabilities through GitHub private vulnerability reporting. Do not disclose the issue publicly until the maintainers have completed an assessment and coordinated a fix.

Include the affected component and version, reproduction steps, impact, and any suggested remediation. The maintainers will acknowledge the report through the private advisory and coordinate status updates there.