Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Contact a repository maintainer directly (see the maintainers listed on the hivecommons organization) with:

• The affected component and the commit or published npm version.
• A description of the issue and its potential impact.
• Steps to reproduce, with any proof-of-concept or logs.

We aim to acknowledge reports within 5 business days, investigate, and coordinate a fix and disclosure timeline with you. Please allow a reasonable time to remediate before public disclosure.