Please report security vulnerabilities privately through GitHub's private vulnerability reporting, not in public issues or pull requests.

Vulnerabilities in DuckDB itself should be reported to the DuckDB project.