Please do not open a public issue for a suspected vulnerability.

Report it privately through GitHub Security Advisories. Include reproduction steps, affected versions, and impact when possible.