Do not open a public issue for a vulnerability that could expose private data, corrupt persisted state, bypass resource limits, or cause unsafe decoding or file access. Use GitHub's private vulnerability reporting for this repository when available.

The project is pre-1.0. Security fixes may change APIs or on-disk formats when required to fail closed.