The canonical vulnerability disclosure process for this repository lives in the root SECURITY.md.

Use that document for:

• private vulnerability reporting instructions
• supported-version expectations
• security response timelines
• baseline repository security controls

Do not open a public issue for a suspected vulnerability.