Do not publish credentials, private URLs, or exploit details in a public issue. Report a concise description, affected version or commit, reproduction conditions, and impact through the repository owner's private contact channel.

Security reports may include exposed secrets, unsafe command execution, permission bypasses, data disclosure, supply-chain risks, or insecure defaults. Please redact secrets from all reports.