Please report suspected security issues privately and do not disclose them in a public issue, pull request, or discussion thread.

Use the GitHub Security Advisories feature for this repository if it is enabled, or contact the maintainers through the private project contact channel.

If you are not sure whether something is security-sensitive, err on the side of caution and report it privately rather than publishing it in public.

When reporting a vulnerability, please include:

• a concise description of the issue
• the affected component, command, or configuration
• the version or commit where the issue was found
• reproduction steps or a proof of concept
• the impact and severity assessment
• any suggested mitigation or remediation

We will do our best to acknowledge reports promptly, evaluate the impact, and coordinate a fix in a reasonable timeframe.

We prefer coordinated disclosure. Please allow enough time for the maintainers to assess and fix the issue before publishing details publicly.

This project is in active development. We recommend using the latest release or the newest commit on the default branch.