Report vulnerabilities privately through GitHub: Security → Report a vulnerability on this repository. Reports are acknowledged within five business days.

Do not open public issues for security problems. Fixes ship as regular releases; the release notes credit reporters who want to be named.