Report a vulnerability privately through GitHub security advisories. Do not open a public issue.

Pin these actions to a full commit SHA or a release tag you have reviewed.