# Disclosure Timeline

| Date | Event |
|---|---|
| 2026-05-31 | The original advisory was published and fix PR #1508 was merged. |
| 2026-06-05 to 2026-06-06 | Independent source review and dynamic validation were performed in an isolated add-on-runtime-equivalent environment. |
| June 2026 | A private vulnerability report was submitted with a detailed write-up and proof of concept. |
| June 2026 | The maintainer confirmed reproducibility and closed the report as a duplicate of GHSA-q855-8rh5-jfgq. |
| June 2026 | A request for independent analyst credit was declined. |
| June 2026 | This public, defensive research record was prepared from disclosed information and sanitized independent observations. |

## Important Context

The independent report was submitted after the original advisory and fix had already been published.

This repository does not claim original discovery or official advisory credit.