Security fixes are provided on the latest default branch.

Please do not report security vulnerabilities in public issues.

Instead, report privately to project maintainers with:

1. A clear description of the issue
2. Impact and affected components
3. Reproduction steps or proof of concept
4. Suggested mitigation if available

Maintainers will acknowledge reports as soon as possible and coordinate a fix and disclosure timeline.