Do not open a public issue for a suspected vulnerability. Use GitHub's private security advisory reporting for this repository and include affected versions, reproduction steps, impact, and any proposed mitigation.

Maintainers will acknowledge a report within seven days, coordinate validation and remediation privately, and publish an advisory after a fix is available. Please allow a reasonable remediation window before public disclosure.

Only the current development branch is supported until the project publishes its first release.