Please do not disclose vulnerabilities in public issues. Report them privately to the repository owner through GitHub's private vulnerability reporting feature, including affected version, reproduction steps, and impact. We aim to acknowledge reports within 7 days.