Do not open a public GitHub issue for security vulnerabilities.

Please report security issues by emailing the maintainers directly. You should receive a response within 48 hours. If you do not, follow up to ensure we received your message.

Please include:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested mitigations

We will acknowledge receipt, investigate, and provide a timeline for a fix. We will credit reporters in release notes unless anonymity is requested.