Please report suspected vulnerabilities privately through GitHub Security Advisories or by emailing the maintainer listed in the root package.json author field. Do not open a public issue for an unpatched vulnerability.

Please include the affected version or commit, the impact, and steps to reproduce when safe to share. We do not promise a response or remediation timeframe; reports are handled as maintainer capacity allows.