Please do NOT open a public issue. Use GitHub's private vulnerability reporting. Include the version, a minimal reproduction, and the impact you believe it has. We aim to respond within 7 days.