Please do not report vulnerabilities in a public issue.
Use GitHub's private vulnerability reporting form under the repository's Security tab. Include the affected version, reproduction steps, impact, and any suggested mitigation. Maintainers will acknowledge the report and coordinate disclosure through the private advisory.