If you discover a security vulnerability, please responsibly disclose it.

• Preferred: email [email protected] (PGP available on request)
• Alternatively, open a private security advisory on GitHub

We will:

• Acknowledge receipt within 72 hours
• Provide a remediation plan and timeline
• Credit reporters (if desired) in release notes