Do not disclose an unpatched vulnerability in a public issue.

Use the repository Security tab to submit a private vulnerability report. Include affected versions, impact, reproduction steps, and mitigation ideas.

Security fixes are normally developed for the latest maintained Heimdall release. Public disclosure should wait until a fix or coordinated mitigation is available.