If you discover a security vulnerability, please report it privately:

1. Do not open a public issue.
2. Send details to the repository owner via a private vulnerability report.

You can expect:

• Acknowledgment within 48 hours
• Regular updates on progress
• Credit once the issue is resolved