Report security vulnerabilities privately to the repository maintainers through GitHub's private security advisory flow. Do not publish credentials, API keys, source media, or exploit details in public issues.

The project accepts reports for the current master branch. We will acknowledge reports, assess impact, and coordinate a fix before public disclosure.