Please do not open a public GitHub issue for security vulnerabilities.

Instead, report them via GitHub's private vulnerability reporting. You'll receive a response within 7 days.

Include:

• A description of the vulnerability and its potential impact
• Steps to reproduce or a minimal proof of concept
• Any suggested remediation if you have one

We'll acknowledge your report, keep you updated as we investigate, and credit you in the advisory unless you prefer otherwise.