Please report suspected vulnerabilities privately through GitHub private vulnerability reporting. Include the affected API or version, impact, reproduction steps, and any suggested mitigation.

If private vulnerability reporting is unavailable, open a minimal public issue asking the maintainer for a private reporting channel. Do not include exploit details, sensitive data, or a proof of concept in that public issue.

Please do not use public issues for undisclosed vulnerabilities. Allow maintainers reasonable time to investigate and coordinate a fix before public disclosure. You should receive an acknowledgement through GitHub; remediation timing depends on severity, reproducibility, and release impact.

Validation limitations or disputed Saudi rules without a security impact should use the evidence update issue template instead.