Please do not open a public issue for security vulnerabilities. Instead, use GitHub's private vulnerability reporting for this repository, or contact the maintainer directly.

Include:

• A description of the vulnerability and its impact
• Steps to reproduce (proof-of-concept if possible)
• Affected version / commit

We'll acknowledge reports within a few days and aim to ship a fix before any public disclosure.

Only the latest release on main receives security fixes.