Security fixes are applied to the latest commit on main.

Please do not open a public issue for security-sensitive reports.

• Preferred: use GitHub's private vulnerability reporting (Security Advisories) for this repository.
• If private reporting is unavailable, open a minimal issue asking for a private contact channel and avoid sharing exploit details publicly.

When reporting, include:

• Affected version/commit
• Reproduction steps
• Potential impact
• Any suggested mitigation