Please do not disclose vulnerabilities in a public issue.

Use GitHub's private vulnerability reporting from the repository's Security tab. Include affected versions, reproduction steps, impact, and any suggested mitigation. The maintainers will acknowledge the report privately and coordinate disclosure after a fix is available.

Only the latest released version receives security fixes.