Please do not open a public issue for a vulnerability that could put users at risk. Use GitHub's private vulnerability reporting for this repository when available. If that channel is unavailable, contact the repository owner privately through the contact method listed on the owner's GitHub profile.

Include the affected component, a minimal reproduction, expected impact and any mitigation you have already identified. Avoid including secrets, personal data or unnecessary exploit automation.

Security fixes target the current main branch. Older snapshots and unmaintained forks are not guaranteed to receive backports.