Report vulnerabilities privately through GitHub Security Advisories for this repository. Do not open public issues for security problems.
- Acknowledgement within 72 hours.
- Fix and coordinated disclosure targeted within 30 days.
- Supported versions: the latest minor release.
Advisories result in a fix(security) pull request and a patch release whose changeset links the GHSA.