Do not report vulnerabilities in public issues. Use GitHub private vulnerability reporting for this repository and include reproduction details, affected versions, and impact.

Security review and fixes currently target the unreleased 1.0 rewrite on main. Include the commit SHA in reports against it; there is no published 1.0 release yet. A 0.x report should identify its released version separately, because the rewrite does not share the 0.x runtime or database format.