Please do not report security issues in the public issue tracker, discussions, or pull requests.

Report them privately through GitHub's private vulnerability reporting: go to the Security tab, choose Report a vulnerability, and fill in the form (direct link). Only the maintainers can see the report.

Please include:

• the affected package and version or commit,
• a description of the issue and its impact,
• steps or a test case that reproduce it.

We'll respond in the advisory, work with you on a fix, and publish the advisory (with a CVE where warranted) once a fixed release is available. Please give us a chance to ship that fix before disclosing the issue publicly.

Fixes are made on main and included in the next release.

The primary maintainer of this repository is Ross Kinder ross@kndr.org