Report vulnerabilities privately to the maintainers. Include reproduction steps, impact, and affected versions. You will receive an acknowledgement and triage update as soon as possible.