Do not disclose suspected vulnerabilities in public issues, pull requests, or discussions. Until a dedicated security contact is published, contact the repository maintainers privately through the email/contact method listed on the project’s GitHub organization profile.

Include the affected version or commit, supported platform, reproduction steps, impact, and any proof-of-concept needed to evaluate the report. Please avoid accessing data you do not own or disrupting services.

We will acknowledge reports, assess severity, work on a fix, and coordinate a public advisory when a fix or mitigation is available. Timelines depend on severity and reproducibility.