Report vulnerabilities privately using GitHub private vulnerability reporting. If that form is unavailable, email rhuan@barreto.work. Do not post tokens or sensitive runner information in public issues.

The latest release in major version 1 receives security fixes. Until the first release, use a reviewed commit SHA. Reports will receive an initial response within seven days where possible.