Security Policy If you find a path-handling or output-safety issue, report it privately before public disclosure.