If you find a security issue in the public repo surface, please open a private report through the repository security workflow or contact the maintainer through the listed commercial channel instead of posting exploit details in a public issue.