Please don't report security problems in public issues. Report them privately through GitHub instead: open the repository's Security tab and choose Report a vulnerability (https://github.com/Xittered/xitter/security/advisories/new).

Things worth reporting privately include anything that lets someone:

• act as another account, or as staff;
• read posts, messages or data they shouldn't see;
• get around a suspension, a block or the admin panel's checks;
• take down or slow down an instance with little effort.

Say what the problem is, how to reproduce it, and which commit you tested. Fixes land on main; there are no separate release branches.