Report vulnerabilities privately through Security → Report a vulnerability on this repository. Do not open a public issue.

Include what you found, how to reproduce it, and the version or commit you tested. You will get a reply within a few days, and a fix or a plan before any public disclosure.

Only the latest release receives security fixes.