If you believe you have found a security vulnerability in this project, please do not open a public issue with exploit details.

Until a permanent security contact is published, use one of the following routes:

• Open a private security advisory in GitHub if repository settings allow it.
• Contact the maintainers through the repository owner's preferred private channel.
• If neither is available, open a minimal public issue that asks maintainers for a private contact path without disclosing the vulnerability details.

Maintainers aim to:

• acknowledge new reports promptly
• reproduce and triage the issue
• coordinate a fix and release plan when needed
• credit reporters if they want attribution

This file is intentionally conservative until the maintainers publish a dedicated security contact and disclosure SLA.