Do not report a suspected vulnerability in a public issue, pull request or discussion. Report it through GitHub's private vulnerability reporting for this repository, which opens a draft security advisory that only you and the maintainers can see.

• the commit you tested, and the affected component or path;
• the steps that reproduce the problem, with synthetic data;
• the behavior you expected and the behavior you observed;
• the impact you believe it has, for example what an attacker could read, change or deny.

The maintainers will acknowledge the report and agree the next steps with you in the private advisory. Please allow time to assess and fix the problem before any public disclosure.

Never post secrets, credentials, tokens or personal data, yours or anyone else's, in an issue, a pull request, a commit or a report. Use synthetic values in reproductions. If a secret has been exposed, say which one and where in the private report, without its value, so the maintainers can revoke it.

Assetgrove is in active development and has no supported release line yet. Report against the commit you tested.