Please do not disclose exploitable parser, deserialization, denial-of-service, or data-integrity issues in a public issue. Report them privately to the repository maintainers with a minimal reproducer, affected revision, and impact assessment. Do not include secrets or production data.

The Rust and .NET packages are currently experimental previews; security reports are welcome, but no response-time or supported-version SLA is promised yet.

For a private report, use GitHub's private vulnerability reporting for Scottlr/Spanfold. If private vulnerability reporting is unavailable, contact the repository owner through the GitHub profile and include the same reproducible details.