Please report vulnerabilities privately to lim@limsumin.com. Include affected versions and a minimal synthetic reproduction. Do not attach real trajectory records, actor identifiers, credentials, or database dumps. Security reports will be acknowledged before public disclosure.