Please do not open a public GitHub issue for security reports.

Email or message the repository maintainer privately (GitHub security advisory preferred when available). Include:

• Affected package version
• Reproduction steps / PoC
• Impact assessment

We will acknowledge receipt and work on a fix or mitigation as appropriate.