If you discover a security vulnerability, please do not open a public GitHub issue.

Instead, report it privately by opening a GitHub Security Advisory or contacting the maintainers through a private channel if you have one.

Include:

• A description of the vulnerability
• Steps to reproduce
• Impact assessment (if known)
• Suggested fix (if any)

We aim to acknowledge reports within a few business days and will work with you on a coordinated disclosure timeline.