Report a suspected vulnerability through the private security advisory feature for this repository. Do not include secrets, keys, customer data, capture payloads, or exploit details in a public issue.

Include the affected component, the observed result, the expected result, and the minimum safe steps that reproduce the problem. Remove all customer and infrastructure identifiers before you send the report.

Do not test a vulnerability against a production service or customer workload. Use an isolated fixture with synthetic data.