Do not open a public issue. Use GitHub's private security advisory form and include the affected version or commit, impact, reproduction steps, and any suggested mitigation.

You should receive an acknowledgement within five business days. We will keep the report private while validating it, preparing a fix, and agreeing on a coordinated disclosure date. Please do not access data that is not yours or disrupt a running service while testing.