Use GitHub's private vulnerability report. Include the affected version, impact, and reproduction steps. Do not open a public issue.

Security fixes target current main and the latest published release, when available. Older releases are not supported.

We aim to acknowledge reports within seven days and coordinate remediation and disclosure timing based on severity. Keep vulnerability details private until coordinated disclosure.