Report suspected vulnerabilities privately via repository maintainers. Include:
- affected version/commit
- reproduction steps
- expected vs observed behavior
- impact assessment
Only the latest release is supported. Older versions may contain unpatched vulnerabilities.