Report a vulnerability by email to [email protected]. Do not open a public issue for it.

Say which package and version you use and how to reproduce the problem. Never send a real API token. If a token leaked, revoke it at https://klaracase.de/settings/api-tokens.

Only the latest release gets security fixes while the package is below 1.0.