Security fixes are provided for the latest published release.

Do not open a public issue for a vulnerability that could damage saves, execute unintended code, or expose local data. Use GitHub's private vulnerability reporting feature on this repository instead.

Include:

• affected version;
• impact and reproduction steps;
• relevant logs or minimal proof of concept;
• any suggested mitigation.

You should receive an initial response within seven days. Please do not disclose the issue publicly until a fix or coordinated disclosure plan is available.