Please report security issues privately. Do not open a public issue, pull request or discussion for them.

Use GitHub's private vulnerability reporting: open the Security tab of this repository, choose Report a vulnerability, and fill in the form. Only the maintainers can see the report, and you can continue the conversation there.

请私下报告安全问题，不要为它开公开的 issue、PR 或讨论。

走 GitHub 的私密漏洞报告：打开本仓库的 Security 页，点 Report a vulnerability，填表提交。 只有维护者能看到报告，后续沟通也在那里进行。

Please include what you can: affected version, platform, the steps that trigger the problem, and the impact you expect. If you already have a proof of concept, attach it to the private report rather than posting it anywhere public.

请尽量写清：受影响的版本、平台、复现步骤，以及你判断的影响。已经有验证代码的话，附在私密报告里， 不要发到任何公开的地方。

Only the latest release is supported. Security fixes ship in a new release; older releases are not patched on their own branches.

只支持最新发布版。安全修复随新版本发布，旧版本不在自己的分支上单独修。

Please reproduce on the latest release before reporting. If the issue only happens on an older version, upgrade first and check whether it is already fixed.

报告前请先在最新发布版上复现。如果只在旧版本出现，请先升级，确认是否已经修好。

We will confirm the report, ask for anything missing, and tell you when a fix is released. We are happy to credit you in the release notes unless you prefer otherwise.

我们会先确认报告、补齐缺失的信息，并在修复发布时告知你。除非你另有要求，我们会在发布说明里署名致谢。