If you discover a security vulnerability, please report it privately to the maintainers by opening an issue labeled security or emailing the repository owner. Avoid public disclosure until a fix is available.