The maintainers provide security fixes for the latest release. Upgrade to the latest patch before reporting an issue that may already have a fix.

Use GitHub's private vulnerability report. Do not open a public issue for a suspected vulnerability.

Include the affected version, operating system, Python version, CPU architecture, reproduction steps, and expected impact. The maintainers will acknowledge the report, investigate it, and coordinate disclosure with the reporter.