Please report security problems privately, not in a public issue: open the repository's Security tab and choose Report a vulnerability.

Include what you did, what happened, and, if you can, a file that shows the problem. Reports are read by the maintainer, and fixes are released as soon as they are ready.

Problems with redaction (content that should have been removed but can still be recovered from a saved PDF) are treated as security issues.

Fixes go into the latest version on main.