Security fixes ship in the latest release of each package. Older versions don't get backports, so upgrade to the latest to pick up a fix.

If you discover a security vulnerability in any @web-kits package, please report it responsibly.

Do not open a public issue. Instead, use one of the following:

1. GitHub Private Vulnerability Reporting (preferred): Go to the Security Advisories page and submit a report.
2. Direct contact: Reach out to @raphaelsalaja on GitHub.

• You will receive an acknowledgment within 48 hours.
• We will investigate and provide an initial assessment within 7 days.
• If the vulnerability is accepted, we will work on a fix and coordinate disclosure with you.
• If the vulnerability is declined, we will explain why.

We appreciate your help in keeping @web-kits packages and their users safe.