If you discover a vulnerability, please avoid public disclosure.

• Open a private security advisory on GitHub, or
• Email: [email protected] (replace with your contact)

Include reproduction steps and expected impact.