Please do not create a public issue for security vulnerabilities.

Report vulnerabilities privately to the repository owner through GitHub private reporting (if enabled) or a direct private channel.

Include:

1. Affected area and impact.
2. Reproduction steps or proof of concept.
3. Suggested remediation (if available).

1. Initial acknowledgement: within 3 business days.
2. Triage and severity assessment: within 7 business days.
3. Fix timeline: based on severity and exploitability.

After a fix is available, coordinated disclosure is preferred. Credit can be provided on request.