Do not disclose suspected vulnerabilities through public issues. Email [email protected] with the subject api-contract-audit security report and include affected versions, reproduction steps, and impact.