Report vulnerabilities privately via GitHub Security Advisories. Do not open public issues for security defects.

Include:

• Affected version/commit
• Reproduction details
• Impact assessment
• Suggested mitigation (optional)

Do not include secrets, credentials, tokens, or private data in reports. Response timelines are not guaranteed by this document.