If you discover a vulnerability, do not post details in a public issue. Report it privately through GitHub Security Advisories.

Include reproduction steps, the potential impact, and a minimal example when possible. We will acknowledge the report and follow up with an impact assessment and remediation plan.