Report suspected vulnerabilities through GitHub private vulnerability reporting.

Please do not disclose a suspected vulnerability in a public issue. Include the affected commit or version, impact, reproduction steps, and any proposed mitigation when available.

Security fixes are applied to the current main branch. Consumers that install an immutable Git commit should compare their pinned SHA with main and update after reviewing relevant fixes.