Report vulnerabilities privately to aaitor@gmail.com with the affected commit, impact, and a minimal reproduction using fictional data. Use private reporting in the Security tab if available. Do not include tokens, private board data, or raw credential output.

Do not open public issues for vulnerabilities or test against another account. Fixes target the latest default branch. This community project has no guaranteed response time. See security and privacy.