Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not include exploit details in a public issue or pull request. If private reporting is unavailable, open an issue asking for a private contact channel without disclosing the vulnerability.

We will acknowledge a report within 5 business days, provide an initial assessment within 14 days, and coordinate a fix and public disclosure with the reporter. We aim to disclose resolved vulnerabilities within 90 days of the report, unless a different timeline is agreed with the reporter.

Security fixes are made against the latest release and the main branch. Please upgrade to the latest release before reporting an issue that may already be fixed.