Please do not report security vulnerabilities in public issues. Send a minimal reproduction and impact description to the repository maintainers through a private channel.

Never include API keys, client secrets, bearer tokens, card data, or real customer information in a report. Maintainers will acknowledge valid reports and coordinate a fix before disclosure.