Security fixes are accepted for the active preview line.

Do not open public issues for security-sensitive reports.

Use GitHub private vulnerability reporting when available for this repository, or contact the repository owner privately through GitHub. Include:

• A description of the issue.
• A minimal reproduction when possible.
• Impacted package version or commit.
• Whether the issue can affect analyzer consumers at build time.

Expected response: triage within 7 days. Confirmed vulnerabilities will be fixed in a patched preview release and documented in the release notes without exposing exploit details before a fix is available.