Report a suspected vulnerability privately through GitHub's private vulnerability reporting for this repository, never in a public issue or pull request. Include the version or commit, the affected path, and steps that reproduce it with synthetic data.