Do not report a suspected vulnerability in a public issue.
Send a concise report to kazkozdev@gmail.com with:
- a description of the issue and its impact;
- steps to reproduce it;
- affected version or commit, if known;
- any suggested mitigation.
Please allow time for a fix before disclosing the issue publicly.