Please do not open a public issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting — this creates a confidential advisory visible only to maintainers. Expect a response within 48 hours.