Please do not open a public issue for a suspected vulnerability that could expose indexed document contents, bypass authentication, escape artifact path confinement, or corrupt an index durably.

Until a private security contact is published, send the repository owner a private message through the hosting platform with a minimal reproduction and the affected version. Avoid including real indexed data or credentials.

Security fixes target the latest release. Older releases may require upgrading.