Security

Report a vulnerability in private. Do not open a public issue for a security bug.

Use GitHub Security Advisories.

Include the package version, the smallest reproduction you can, and the impact you see. A maintainer will answer on the advisory.