Security fixes are made against the latest main branch.

Please do not open a public issue for a potential security vulnerability. Use GitHub private vulnerability reporting and include:

• a clear description of the impact;
• steps to reproduce it safely;
• the affected version or commit; and
• a suggested mitigation if one is known.

Examples include SSRF or redirect-bypass paths, secrets exposure, unsafe source collection, authorization flaws, injection issues, and data leakage. We will acknowledge a valid report, investigate it, and coordinate a fix before disclosure.

Do not include production credentials, applicant data, or a payload that causes harm.