Please do not disclose a suspected vulnerability in a public issue.

Use GitHub private vulnerability reporting for this repository when it is available. If that feature is unavailable, contact the repository owner privately through an appropriate channel listed on their GitHub profile. Include the affected version, impact, reproduction details, and any suggested mitigation. Avoid including real secrets or sensitive repository content.

Maintainers will acknowledge a report when practical, investigate it, and coordinate disclosure after a fix or mitigation is available.