Please report security issues privately before public disclosure.
Include:
- Affected version/commit
- Impact summary
- Reproduction steps or proof-of-concept
- Suggested mitigation (if any)
If contact details are not yet published, open a private channel first (for example, via repository owner contact) and avoid filing public issues for vulnerabilities.
This policy covers the source code in this repository and release artifacts produced from it.