Do not open a public issue for security vulnerabilities.

Use GitHub's private vulnerability reporting:

1. Go to this repository's Security tab.
2. Click Report a vulnerability.
3. Fill in the advisory form.

If private vulnerability reporting is not enabled, contact the maintainers via the method documented in SUPPORT.md.

Include: description, steps to reproduce, potential impact, suggested fix.

Security research conducted in good faith is authorized. We will not pursue legal action against researchers who act responsibly.