Do not report security vulnerabilities in public issues. Use GitHub's private vulnerability reporting for this repository, or contact the repository owner through the security contact listed in the GitHub repository settings.

Include the affected version or commit, platform, build configuration, a reproducer where safe, and the impact you observed. Do not include secrets, private documents, or personal data.

Security-sensitive areas include protocol frame handling, CBOR validation, partial stream I/O, untrusted UI payloads, resource bounds, platform input, clipboard integration and native window services.