Report vulnerabilities privately through GitHub security advisories. Treat every pack file and text field as untrusted; do not disable limits, hash verification, containment, integrity checks, or read-only defenses.