Do not disclose an unpatched vulnerability in a public issue.

Use the repository's Security tab and select Report a vulnerability to submit details privately. If private vulnerability reporting is unavailable, open a public issue requesting a private contact channel without including exploit details, sensitive logs, memory contents, or personal information.

Include the affected version, Windows version, reproduction conditions, and the expected security impact when possible.

Reports concerning unsafe process access, unintended writes, restore failures, privilege handling, release packaging, or dependency integrity are welcome.