Please report suspected vulnerabilities privately through GitHub's security advisory form for this repository. Do not open a public issue containing exploitation details or credentials.

Security fixes should include a regression test and an update to the relevant plan under private_/out/review/ before release.