Report a suspected vulnerability privately via GitHub Security Advisories rather than a public issue. Do not open a public issue for a suspected vulnerability until a maintainer confirms it's safe to discuss openly.

This policy will be expanded once there is a released version to scope it against.