Report security vulnerabilities privately, not through a public issue or pull request.
Prefer opening a private vulnerability report on GitHub. Alternatively, email daniel@roe.dev.
Include the affected version, a description of the issue, and reproduction steps or a proof of concept if available.