Please report security vulnerabilities privately via GitHub Security Advisories.

Do not open a public issue for security reports.

You can expect an initial response within 7 days. If the report is accepted, we will work with you on a fix and coordinated disclosure. If it is declined, we will explain why.