Report vulnerabilities through GitHub private vulnerability reporting. If unavailable, request a private contact in an issue without disclosing the defect. Include the version, platform and a minimal reproducer. See the API guide for memory, ownership and filesystem contracts.