Please do not open a public issue for security-sensitive bugs.

Use GitHub Security Advisories (private report) so maintainers can assess and release a fix responsibly.

Include:

• A clear description and impact
• Steps to reproduce or a minimal code sample, when safe to share
• Whether the issue involves Vercel Connect, OAuth flows, or provider tokens

We will triage reports as soon as we can. Thank you for helping keep users safe.