Please report security problems privately using GitHub's Report a vulnerability button on this repository's Security tab (private vulnerability reporting).

Do not open public issues, pull requests, or discussions for security problems. Public reports can expose users before a fix exists.

Only the main branch is supported. Fixes land there; older commits and forks are not patched.

This policy covers the code in this repository. It does not cover any specific deployment, host, or operator configuration; do not probe or test running instances you do not own.