Security fixes target the latest 2.x release.

Use GitHub's private vulnerability reporting for this repository. Do not open a public issue for credentials, archive traversal, executable installation, process ownership, or network trust vulnerabilities.

Include the affected version, platform, reproduction steps, impact, and any proposed mitigation. Reports will be acknowledged after review and coordinated disclosure will be preferred.