Please do not disclose suspected vulnerabilities in a public issue or discussion.

For repositories with private vulnerability reporting enabled, open the repository's Security tab, select Advisories, and choose Report a vulnerability. Include:

• the affected project and versions;
• steps to reproduce or a proof of concept;
• the potential impact; and
• any known mitigations.

If private reporting is not available for a UDST repository, contact a repository maintainer privately before sharing technical details publicly.

Maintainers will acknowledge the report, assess its scope and severity, and coordinate disclosure and remediation with the reporter. Security fixes may use an expedited review and release process, while still receiving appropriate testing and maintainer review.