Report suspected vulnerabilities using the affected repository's GitHub Report a vulnerability action. Include the affected version, a minimal reproduction, and the impact. Do not include passwords, API secrets, tokens or private data in a report.

The current release of each active library and the default branch of each repository receive security fixes. Fixes ship as new versions; published releases are not changed.

Maintainers give a first answer within 14 days of a report. A fix has no promised date; how long it takes depends on the case.

Please allow maintainers to assess and fix an unpatched vulnerability before publishing exploit details. Ordinary bugs and feature requests belong in issues.