Please report security vulnerabilities privately — do not open a public issue.

• Preferred: use GitHub's private vulnerability reporting on the affected repository (the Security tab -> Report a vulnerability).
• Or: email eng@plasma.ai.

We will acknowledge your report as quickly as we can and keep you updated on the fix. Please give us a reasonable window to address the issue before any public disclosure.