Security fixes are applied to the default branch and the most recent production release.

Please report suspected vulnerabilities privately through GitHub's private vulnerability reporting channel for this repository. Do not open a public issue or include credentials, tokens, personal data, or production payloads.

Include the affected component, a concise reproduction, impact, and any recommended mitigation. We will acknowledge a valid report and coordinate disclosure after a fix or mitigation is available.