Report vulnerabilities privately via GitHub Security Advisories.

Include reproduction steps and affected versions. Expect an initial response within 7 days. Please do not open public issues for security reports.