Please do not report a suspected vulnerability in a public issue or pull request. Use GitHub's private vulnerability reporting flow for this repository when available. If that flow is unavailable, contact a repository maintainer privately before sharing exploit details.

Include the affected revision, component, reproduction steps, impact, and any mitigation you have tested. Do not include credentials, customer data, or production identifiers in the report.

Security fixes should include a regression test or a clear explanation of why a test cannot safely reproduce the issue. Maintainers will coordinate disclosure and release timing after the affected boundary is understood.