Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via GitHub's Security Advisories or by emailing the maintainers directly (see repository contact info).

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fix (optional)

We follow coordinated disclosure:

1. You report privately.
2. We acknowledge within 48 hours.
3. We work on a fix and keep you informed.
4. Once a fix is released, we credit you (unless you prefer anonymity) and publish a security advisory.
5. Public disclosure happens after the fix is available.

Thank you for helping keep XStreamRoll secure.