Report vulnerabilities privately through GitHub's security advisory form.

Include the version or commit, the smallest reproduction, and what an attacker gains. We acknowledge within a few working days and agree a disclosure timeline before publication.