Please report suspected vulnerabilities privately to the maintainer. Include the affected feature, steps to reproduce using your own test workspace, and potential impact. Do not include passwords, payment details, or customer data.

Do not disclose unpatched vulnerabilities in public issues. Please avoid testing against other people's accounts, sending unsolicited messages, or making real charges. A sandbox payment environment does not make other users' data public.

Reports will be reviewed and disclosure coordinated after a fix is available.