Please report a suspected vulnerability privately through GitHub Security Advisories. Do not include secrets, credentials, private Foundation Plans, or .firstdraft/state.json contents in a public Issue.