Report a suspected vulnerability through GitHub private vulnerability reporting. Do not open a public issue for a suspected security defect.

Include the affected version or commit, component, environment, reproduction steps, and expected impact. Do not include credentials, confidential data, or other secrets. Maintainers will coordinate disclosure and remediation through the private advisory.

Ordinary numerical discrepancies, modeling questions, and correctness bugs without a security impact belong in the public issue tracker.