Report security vulnerabilities privately, not through a public issue or pull request.

Prefer opening a private vulnerability report on GitHub. Alternatively, email daniel@roe.dev.

Include the affected version, a description of the issue, and reproduction steps or a proof of concept if available.