SECURITY / REPORT PRIVATELY
Report a vulnerability privately, not in a public issue.
A public issue exposes a vulnerability before there is a fix for it. Report it privately instead.
How to report
Email [email protected] with a description and, if you can, the smallest request that reproduces the issue. Do not open a public issue or discuss it publicly until a fix has shipped.
What to expect
An acknowledgement, then a fix or a mitigation before public disclosure. Supported versions and a formal response-time commitment will be published here as the project matures.