Use GitHub's private vulnerability reporting for this repository. Include the affected package version, a minimal reproduction, likely impact and any known mitigations. Do not include live credentials, private email or personal data.

A valid MAP document remains untrusted input. This package does not authenticate a service, grant authority or approve an action. Implementations must enforce endpoint trust, current credentials, permissions and policy before execution.