Do not open a public issue for security vulnerabilities. Report them privately via private vulnerability reporting.

Please include:

• Affected version, tag, or commit
• Description of the issue and its impact
• Steps to reproduce, exploit, or proof of concept (if available)

• Acknowledgement of your report within 7 days.
• A fix or mitigation on a best-effort timeline; credit in the release notes if you want it.
• Please do not disclose the issue publicly until a fix is released.

Security fixes are provided for the latest release on the default branch. Older releases are supported on a best-effort basis only.