Security fixes are released for the latest minor version on NuGet.

Please report vulnerabilities privately through GitHub: use the "Report a vulnerability" button in the repository's Security tab. Reports are visible only to maintainers.

Please do not open a public issue for security problems.

Include as much detail as you can:

• a description of the vulnerability
• steps to reproduce
• affected versions and configuration
• potential impact

We will acknowledge the report and assess it promptly. Fixed vulnerabilities are announced in the GitHub release notes and submitted to the GitHub Advisory Database, which NuGet reads.

• dotnet restore audits every package against the GitHub Advisory Database. Every package version is pinned exactly in Directory.Packages.props; the published packages depend on none.
• Dependabot keeps packages and GitHub Actions current.
• Every GitHub action is pinned to a commit SHA.
• Centrifugal.Cent depends on nothing but .NET: cryptography is the platform's, and Ed25519 comes from a library of the application's choice.