Please report suspected vulnerabilities privately to the maintainer listed in composer.json. Do not open a public issue until a fix and disclosure plan are available.

Include the affected version, configuration, reproduction steps, impact, and any proposed mitigation. Never include real encryption keys or production ciphertext that may contain sensitive information.

Security fixes are provided for the current major release. Users should keep Symfony, Doctrine, PHP, and OpenSSL on supported patch versions and run composer audit regularly.