Use Report a vulnerability in this repository's GitHub Security tab. Do not open a public issue for suspected vulnerabilities, leaked credentials, release-signing problems, or package-supply-chain incidents.

Include affected versions, reproduction details, impact, and any suggested mitigation. Do not include third-party credentials, private keys, tokens, or personal data in the report.

Install only from the routes in the installation guide. Each GitHub Release publishes its source archives, checksums, manifest and SBOMs with signatures you can verify.

If release integrity is in doubt, stop installing the affected version and report it privately through GitHub Security Advisories.