Security fixes are applied to the latest version on main.

Please do not open a public GitHub issue for security-sensitive reports.

Send a private report to the maintainer with:

• A description of the issue
• Reproduction steps
• Impact assessment
• Any suggested remediation

I will validate the report, work on a fix, and coordinate disclosure once a patch is available.