Report vulnerabilities privately to project maintainers. Do not open public issues for path traversal, unsafe deletion, arbitrary file write, credential exposure, or font parser crashes.

Fontsequal must never log Google API keys, write system font folders, or delete external fonts.