Please do not report security vulnerabilities in public issues, pull requests or discussions.

Report it privately through GitHub: open the affected repository's Security tab and choose Report a vulnerability. Only the maintainers see the report.

Include what you can of:

• the repository, and the version, tag or commit affected;
• what an attacker can do, and what they need first;
• steps or a proof of concept to reproduce it.

We acknowledge a report within 5 working days, and keep you updated until it is fixed or closed. We credit reporters in the advisory unless you ask us not to.

Security fixes go into the latest release of each project. Older releases are not patched unless a project's own SECURITY.md says otherwise.