Do not open a public issue for a security vulnerability. Use GitHub's private vulnerability reporting to contact the maintainers privately.

Include the affected version, reproduction steps, impact, and any suggested remediation.