Please report vulnerabilities privately, never in public issues or pull requests.

1. Preferred: GitHub private vulnerability reporting. Open the repository's Security tab and click Report a vulnerability. The report stays private until a fix is published.
2. If you cannot use GitHub: email security@theweft.org.

Please include a description, affected versions and, if possible, steps or an input that reproduces the problem. We acknowledge reports within 3 working days and coordinate disclosure with you. Reporters are credited in the advisory unless they prefer otherwise.

Only the latest release receives security fixes until a long-term support policy is published.