Please do not open a public issue for security vulnerabilities.

Report via GitHub private security advisories. We aim to acknowledge reports within 3 business days and to issue a fix within 30 days for confirmed vulnerabilities.