Please do not open public issues for security vulnerabilities.
Report privately to maintainers with:
- affected paths
- reproduction steps
- impact assessment
- proposed mitigation if available
- Initial acknowledgment: within 72 hours
- Triage outcome: within 7 days
- Fix timeline: based on severity and risk
We coordinate responsible disclosure and publish advisories after mitigation is available.