If you find a security issue:

• Please do not open a public issue with exploit details.
• Open a private GitHub issue if the repo is private, or contact the maintainer directly if the repo is public.

When reporting, include:

• Steps to reproduce
• Expected vs actual behavior
• Whether secrets/captured traffic might be involved