Security fixes are provided for the latest release on the default branch.
Please do not post vulnerability details in public issues, discussions, or pull requests.
Preferred reporting path:
- Use GitHub private vulnerability reporting for this repository if it is enabled.
- If private reporting is unavailable, open a minimal public issue asking for a private contact channel. Do not include exploit details, payloads, or sensitive data in that issue.
Include enough information for maintainers to reproduce and assess the issue, such as affected version, platform, and expected vs. actual behavior.
Maintainers will acknowledge good-faith reports when possible and coordinate a fix or mitigation before public disclosure when appropriate.