Do not open a public issue for a suspected vulnerability. Use this repository's private vulnerability-reporting form and include the affected revision, reproduction steps, and potential impact.

Security fixes apply to the latest supported major release.

The Action processes untrusted pull-request content. Changes must preserve the controls in Security model, including exact-head pinning, trusted support code, minimal permissions, secret isolation, and artifact data minimization.