Please report security issues privately instead of opening a public issue.

Send a short report with the affected helper, a minimal reproduction, and expected impact. Do not include live credentials, cookies, OAuth tokens, or private account data.

This package should stay deterministic and offline-safe. Fixtures and tests must use public examples or synthetic data.