Please do not report security vulnerabilities in public GitHub issues, discussions, or pull requests.

Private vulnerability reporting is enabled on GitHub for this repository and is the preferred reporting channel:

1. Go to the repository Security page.
2. Open the advisories section.
3. Use Report a vulnerability to send the report privately.

When possible, include:

• A clear description of the issue and impacted package surface or workflow.
• Steps to reproduce the problem or a proof of concept.
• The affected package version(s) and runtime (Node.js, Android, iOS) version.
• Any suggested mitigations or fixes you are aware of.

We will review the report, acknowledge receipt, and coordinate remediation privately.