Do not report vulnerabilities in public issues.

Use GitHub private vulnerability reporting for this repository. Include the affected component, reproduction steps, impact and any known workaround. Do not include real user data, credentials or private employer material.

The maintainers will acknowledge a valid report, coordinate remediation and publish disclosure details when a fix is available.