Please report vulnerabilities privately to the maintainers rather than opening a public issue. Include reproduction steps, affected version, and impact. Do not include credentials in reports. We aim to acknowledge reports within seven days.