Use GitHub private vulnerability reporting for this repository if the Report a vulnerability option is available. Otherwise contact the repository owner through a private GitHub channel. Do not publish exploit details, credentials, exact local artifacts, or affected user data in a public issue.

Include the affected version, platform, impact, minimal reproduction, and any suggested mitigation. You should receive an acknowledgement through the same private channel. Public disclosure and credit will be coordinated after a fix is available.

For the data-handling design, see docs/security.md.