Security updates are applied to the latest version on the main branch only.
Please do not report security vulnerabilities via public GitHub issues.
Instead, use GitHub's private vulnerability reporting to submit a report. Please include:
- A description of the vulnerability
- Steps to reproduce
- Any suggested fixes or mitigations
I'll aim to respond within a week. If you'd like to be credited in any disclosure, let me know — otherwise I'm happy to keep reports anonymous.