Please do not disclose vulnerabilities in public issues.

Use GitHub's private vulnerability reporting feature when enabled. Until it is enabled, contact the repository owner through the private contact method listed on their GitHub profile and include:

• affected component and version/commit;
• reproducible impact;
• minimal proof without real user data;
• suggested mitigation if known.

Do not include credentials or exploit other users. Receipt should be acknowledged within 5 business days. Remediation timing depends on severity and validation.

Security support is handled per release and commit. Check the repository history and release notes for the version under review.