Please do not publish a vulnerability in an issue, pull request, chat, or hardware report. Send a private report through the security contact listed on the repository's GitHub security page.

Include the affected release or commit, the smallest reproduction you can share safely, and the impact. Do not attach passwords, private keys, tokens, full disk images, or unredacted diagnostic bundles.

Until a fix is available, keep the report private. Maintainers will confirm receipt, assess affected versions, coordinate a fix, and publish a concise advisory when users can act on it.