Please report suspected vulnerabilities privately through this repository's private vulnerability-reporting feature. Do not open a public issue for a potential security problem.

Include enough detail to reproduce the issue safely, such as the affected version, impact, steps to reproduce, and any proof of concept.

Reports about vulnerabilities in the application, its build and release process, dependencies, and repository automation are in scope.

Reports are reviewed as time permits. Acknowledgment and remediation timelines depend on severity, reproducibility, and available maintainer capacity.