If you discover a security vulnerability, please do not open a public issue.

Preferred: use GitHub's Private Vulnerability Reporting if available on this repository.

If that is not available, contact the maintainers privately (e.g., via organization email) and provide:

• A clear description of the issue and impact
• Steps to reproduce
• A proposed disclosure timeline

We aim to acknowledge reports within 72 hours and will coordinate on fixes and disclosure.