Report vulnerabilities privately through GitHub's security advisories for this repository, or by email to [email protected]. Do not open a public issue for a vulnerability.

You will get an acknowledgement within a week. Fixes are released as a new version on Hex with an entry in CHANGELOG.md; the advisory is published once that version is out.

Only the latest release on Hex receives fixes.