Please report vulnerabilities privately through GitHub's private vulnerability reporting form.

Do not open a public issue for a vulnerability that could expose credentials, alter a published release, or let the bot land code without human review.