The latest 3.x release gets security fixes.

Report it in private. Use GitHub private vulnerability reporting:

https://github.com/dartondox/dox/security/advisories/new

Do not open a public issue for a security problem.

• We reply within 7 days.
• We fix confirmed issues.
• We publish a GitHub Security Advisory.
• We name the fix in the release notes.

This policy covers the packages in this repo:

• dox_core
• dox_annotation
• dox_builder
• dox_cache

Packages in other dartondox repos have their own SECURITY.md, or use the same process in their repo.