We take the security of our projects seriously. Thank you for helping us keep them, and the people who use them, safe.

Unless a project states otherwise, security fixes are only applied to the latest released version. Please make sure you can reproduce the issue on the most recent release or the default branch before reporting.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Instead, report them privately through GitHub's private vulnerability reporting:

1. Go to the Security tab of the affected repository.
2. Click Report a vulnerability.
3. Fill in the form with as much detail as possible.

To help us triage and resolve the issue quickly, please include:

• The affected repository, package and version (or commit).
• The type of issue (e.g. XSS, SQL injection, authentication bypass).
• Step-by-step instructions to reproduce the issue.
• A proof of concept or exploit code, if available.
• The potential impact, including how an attacker might exploit it.

• We will acknowledge your report as soon as possible.
• We will investigate, keep you informed of our progress and may ask for additional information.
• Once the issue is resolved, we will publish a security advisory and credit you for the discovery, unless you prefer to remain anonymous.

We ask that you give us a reasonable amount of time to address the issue before disclosing it publicly. Please do not access or modify data that does not belong to you, and do not degrade the availability of our services while investigating.