Report vulnerabilities privately through GitHub's "Report a vulnerability" on this repository. Please do not open a public issue.

In scope: reading files outside the project root, leaking the API key, state or report content that lets repository content forge or redirect a verdict, and anything that makes a hostile repository produce a silent dismissed.