Please use GitHub private vulnerability reporting or a repository security advisory when that feature is available. Do not disclose vulnerabilities in public issues, pull requests, or discussion threads.

Reports may include dependency issues, parsing or validation problems, denial-of-service risks, and attempts to bypass the observation-only authority boundary. Include the affected version, a concise impact description, reproduction steps, and any safe proof-of-concept details.

Do not include credentials, tokens, personal data, or other unrelated secrets in a report.