Please do not report vulnerabilities in public issues, discussions, or pull requests.
Report privately through GitHub Security Advisories:
https://github.com/thexjs/x/security/advisories/new
The full security model, supported versions, and response policy live in the main repository: