Please do not report security vulnerabilities in public issues.

Use GitHub's private vulnerability reporting. Include the affected package version, impact, reproduction steps, and any known mitigations. Maintainers will acknowledge the report and coordinate disclosure through that private thread.