Please report security issues privately. Do not open a public GitHub issue.

1. Prefer GitHub private vulnerability reporting on this repository (creates a draft GHSA the maintainers can publish after a fix).
2. Or email [email protected].

We will acknowledge the report and follow up on a fix. Reporters who want credit can be named on the advisory when it is published.