Please do not open public GitHub issues for security vulnerabilities.

Instead, report privately via GitHub Security Advisories.

We aim to acknowledge reports within 5 business days and ship a patch within 30 days for confirmed issues.