Please do not open a public issue for security vulnerabilities.
Use private vulnerability reporting to report issues directly and confidentially.
Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
You'll receive a response within 7 business days.
Only the latest version on main receives security fixes.
Once a fix is available, vulnerabilities will be disclosed via a GitHub Security Advisory.