Please open a private security advisory on this repository rather than a public issue: Security → Advisories → Report a vulnerability.

Include what you found, how to reproduce it, and what you think the impact is. I will acknowledge within a few days.

The full threat model, including risks that are known and deliberately unmitigated, is in THREAT_MODEL.md.