Security fixes are made on the current main branch of this public mirror.

Do not include exploit steps, credentials, private URLs or personal data in a public issue. Use GitHub's private vulnerability-reporting feature for this repository when it is available. If it is unavailable, open a public issue only to request a private contact channel; do not include technical details.

Include the affected path, observed impact, a minimal reproduction without sensitive data and any proposed mitigation. Reports are acknowledged after the scope can be reviewed.