Doran is pre-1.0, so security fixes land in the latest release — please keep up to date.

Please don't report security issues in public GitHub issues.

Instead, report it privately via GitHub's private vulnerability reporting.

Helpful details to include:

• the affected package and version,
• what the vulnerability is and its impact,
• steps to reproduce or a proof of concept,
• any suggested fix.

I'll do my best to respond quickly, keep you updated, and credit you in the advisory (unless you'd rather stay anonymous).