Report suspected vulnerabilities privately through GitHub vulnerability reporting. Do not include vulnerability details in public issues or pull requests.

Include the affected MapperGen version, a minimal reproduction, the potential impact and relevant Node.js/build-tool versions. Remove credentials and private application data from examples.

The maintainer will review the report and coordinate any fix and disclosure through the private report. Security fixes target the latest release; older versions do not have a separate maintenance branch.