Do not open a public issue for a suspected vulnerability. Use the repository's private security advisory form. If private reporting is unavailable, contact the maintainer through the repository owner's GitHub profile.

Include the affected version or commit, a minimal reproduction, impact, and any mitigation already identified. Avoid publishing an exploit or sensitive input until maintainers have assessed the report.

Security fixes are assessed against the latest published release and the default branch. Older releases may require an upgrade before a fix can be provided.