Please report suspected security vulnerabilities privately. If this repository is hosted on GitHub with private vulnerability reporting enabled, use Security → Advisories → Report a vulnerability. If that private reporting option is unavailable, contact the repository owner through GitHub using a private channel and ask for a secure way to share the report. Do not post exploitable details in a public issue, discussion, or pull request. No security-reporting email address is currently published.
Include the affected version or commit, impact, reproduction steps, and any proof of concept needed to assess the issue. Redact credentials, access tokens, personal data, and private repository content.
Please allow maintainers reasonable time to investigate and prepare a fix before public disclosure. There is no published response-time guarantee or bug-bounty program.
Until a release support policy is published, report issues affecting the current default branch.