If you discover a security vulnerability, please open a private report via GitHub's security advisories or contact the maintainer directly.

Include steps to reproduce, severity, and any potential mitigations.