Please use GitHub private vulnerability reporting (Security tab of this repository) rather than opening a public issue. Include steps to reproduce where possible.

We do not offer bounties or SLAs; this is a small open-source project — but reports will be taken seriously and credited on request.