Security issues involving encryption, archive parsing, path handling, memory safety, authentication of package data or unsafe extraction should be reported privately through GitHub security reporting when available.

Do not publish keys, private game files or exploitable vulnerability details in public issues.

Include the affected version/commit, component, reproduction steps and impact when safe. Third-party libraries may require separate upstream reports.