Do not report security vulnerabilities in public issues.

Use GitHub's private vulnerability reporting feature for this repository. Include the affected version, impact, reproduction steps, and any suggested mitigation. Maintainers will acknowledge a complete report as soon as practical and coordinate disclosure after a fix is available.

Only the latest released minor version receives security fixes before v1.0.