Please do not open a public issue for a vulnerability that could expose local files, execute code, or make the local API reachable from another machine. Report it privately through GitHub's Security advisories → Report a vulnerability feature.

Include the affected version, reproduction steps, impact, and any suggested mitigation. Maintainers should acknowledge a report within seven days.

Only the latest release receives security fixes.