Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities via GitHub private security advisory. This keeps the report confidential until a fix is ready.

Include in your report:

• Description of the vulnerability and its potential impact
• Steps to reproduce or proof-of-concept
• Affected versions or components
• Any suggested mitigations (optional)

1. You submit a private advisory.
2. Maintainers acknowledge receipt within 5 business days.
3. Maintainers investigate and develop a fix.
4. A patched release is published.
5. The advisory is made public after the patch is available.

Reporters who follow this process will be credited in the advisory unless they request otherwise.

This policy applies to code and configuration in this repository. Dependencies with known vulnerabilities should be reported to their respective upstream projects.