This package is pure computation (no I/O, no network, no unsafe), but ranking manipulation bugs — inputs that let an attacker game feed placement — are treated as security issues.

Report vulnerabilities privately via GitHub Security Advisories. Please do not open public issues for exploitable reports. Supported version: the latest release.