Please report suspected vulnerabilities privately. Do not open a public issue.

Include:

• a concise summary,
• steps to reproduce,
• the affected component,
• any relevant environment details.