Please do not open a public GitHub issue for security vulnerabilities.

Instead, report them privately via one of:

• GitHub Security Advisories (preferred): Security → Report a vulnerability on this repository
• Discord: join the Nexora Discord server and DM the maintainer ogcjay, or open a private ticket if available

Include:

1. Description of the vulnerability
2. Steps to reproduce
3. Affected package / version
4. Potential impact
5. Suggested fix (optional)

We aim to acknowledge reports within 72 hours and provide a status update within 7 days.

Please give us reasonable time to publish a fix before any public disclosure.