Please report security issues via a GitHub Security Advisory. If that is not available, open an issue with a clear "SECURITY" prefix and no sensitive details.
- Acknowledge within 7 days
- Provide a remediation plan or status update within 30 days
- Target fix within 90 days for confirmed issues