Report suspected vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue or disclose details before a coordinated fix is available.

While Sheetwrite is pre-1.0, security updates are provided for the latest published minor release. Upgrade to the latest release before requesting a backport. Include affected versions, impact, reproduction details, and any proposed mitigation in the private report.