Please do not report security vulnerabilities through public GitHub issues.

To report a vulnerability, email [TODO: Add your security contact email] with:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a proof-of-concept
• Any suggested mitigations if you have them

You should receive a response within 72 hours. If you do not, follow up to make sure your message was received.

Once a fix is available, we will:

1. Release a patched version
2. Publish a security advisory on GitHub
3. Credit the reporter (unless they prefer to remain anonymous)