Do not disclose vulnerabilities publicly through issues or pull requests. Contact the repository's maintainers through their established private security channel, including a minimal synthetic reproduction and affected revisions. No public security-response SLA is promised here. Never send production financial datasets, bank credentials, member identity documents or administrator tokens in a report.