If you discover a security vulnerability, please open a GitHub Security Advisory rather than a public issue.

We will acknowledge receipt within 48 hours and work on a fix. Please do not disclose the issue publicly until a patch is released.