Please report security issues privately to the maintainers before public disclosure. Include:

• impact assessment
• reproduction steps
• affected endpoints/components

Do not open public issues for exploitable vulnerabilities until triage is complete.