The immutable full commit SHA shown in the README is the supported Action revision. Floating tags are not part of the security contract.
Use GitHub's private vulnerability reporting for this repository. Include the affected commit, runner platform, reproduction steps, and expected impact. Please do not open a public issue for an undisclosed vulnerability.