Report suspected vulnerabilities through GitHub private vulnerability reporting. Please do not put credentials, personal data, or exploit details in public issues.

Include the affected revision, reproduction steps, and potential impact. Remove secrets from logs and examples. If a credential has been exposed, revoke it with its provider; deleting a file does not remove it from Git history.

Security reports are welcome for the default branch. Older revisions have no guaranteed backports, and this project does not offer a response-time commitment.