Do not open a public issue for suspected vulnerabilities. Email [email protected] with the affected repository, impact, reproduction steps, and a safe contact method. Do not include live secrets or personal data.

We aim to acknowledge complete reports within five business days. No bounty program is promised. Supported releases are the latest tagged release and the default branch.