Report it privately at https://github.com/pqoqubbw/zriz/security/advisories/new. Please do not open a public issue, discussion or pull request about it.

Tell me the package and version, what an attacker can do, and the smallest code or steps that show it. A crafted image or SVG that runs script, reads pixels across origins, or freezes the page is the kind of thing I want to hear about.

I maintain zriz alone. I reply within 7 days. Once a fix is released, I publish a GitHub security advisory and credit you, unless you would rather stay anonymous.

@zriz/core and @zriz/react always release together under one version number. Fixes land in the next release only, so upgrade to get them.

This covers the two npm packages, the docs site at zriz.dev, and the GitHub Actions workflows in this repository.