Only the latest release receives fixes.

Report a vulnerability privately through GitHub's private vulnerability reporting, or by email to [email protected]. Do not open a public issue.

Include the version, the language, and an input that reproduces the problem. You should get a reply within a week.

The library is extractor, lang, postag, and rarity. The HTTP server in cmd/server is a local development tool, and POST /v1/text fetches any URL it is given, including private addresses. Do not expose it to a network. Reports about that behaviour are out of scope.