Email info@zactonz.com with the subject "Security: zactonz-php". Please do not open a public issue.

Include the version, what you found and how to reproduce it. You will get an acknowledgement within three business days and an assessment within ten. A fix is released before the details are made public, and you are credited in the changelog unless you prefer not to be.

A vulnerability in the API itself, rather than in this library, can be reported the same way.

Security fixes are made to the latest release.