Report vulnerabilities privately through GitHub Security Advisories. Avoid posting private collection filenames publicly. The parser does not open archives, but path handling, output safety, and dependency concerns are in scope. The current release receives security fixes.