Do not disclose suspected vulnerabilities in a public issue. Report them privately through GitHub's private vulnerability reporting. Include reproduction steps, affected versions, and potential impact.

The maintainer will acknowledge a complete report as soon as practical and coordinate remediation and disclosure with the reporter.