Report security issues privately to ck@ckmadethis.com.

Please include:

• affected version or commit
• reproduction steps
• expected impact
• any relevant logs or command output

Do not open a public issue for a vulnerability until it has been triaged.