Report vulnerabilities privately to Ivan Zorin, creator@localzet.com. Include versions and a minimal reproduction; do not post secrets or user data in public issues. Fixes are checked on the default branch; older-version maintenance is not established. See README for current limitations.