Do not open a public issue for security problems.

Use GitHub private vulnerability reporting: Security → Report a vulnerability on the affected repository. Reports are handled privately through GitHub. Include the affected project and version or commit, the impact, and clear steps to reproduce the issue.

We support only the latest release of each project for security fixes. Please reproduce vulnerability reports against the latest release when possible.

• For confirmed vulnerabilities, we coordinate the fix privately, then publish the release and advisory.
• The advisory credits you unless you ask us not to.