Please do not open a public GitHub issue for security-sensitive problems.

Instead, report vulnerabilities privately through GitHub's security reporting flow if it is enabled for the repository. If that is not available, contact the maintainer directly through the repository owner profile and include:

• a clear description of the issue
• affected files, endpoints, or workflows
• reproduction steps if available
• impact assessment
• any suggested mitigation

Examples include:

• hosted API trust-boundary or injection issues
• unsafe link handling in clients
• credential or secret exposure
• authorization or deployment misconfiguration that exposes internal systems

I will review credible reports as quickly as practical, confirm impact, and work toward a fix before public disclosure.