Please do not open a public issue for security-sensitive problems.

Instead, contact the maintainers privately and include:

• a description of the issue
• steps to reproduce
• affected files or endpoints
• any proposed mitigation

We will acknowledge receipt as quickly as possible and work on a fix.