Please report vulnerabilities privately via security@yourdomain.example.
Do not open public issues for sensitive reports. We aim to respond within 72 hours.