If you believe you have found a security issue, do not open a public issue.

Instead, report it privately to the maintainers using the security contact mechanism described in the repository settings. Include:

• a clear description
• steps to reproduce
• affected files or commands
• any relevant logs (redact secrets)

Reports are acknowledged promptly and triaged based on impact and exploitability. Fixes are released with a security note in the changelog when appropriate.