Use this repository's private vulnerability reporting feature for sensitive findings. Do not disclose credentials, customer data, raw runtime logs or support bundles in public issues or pull requests. Provide a minimal synthetic reproduction when possible.