Security fixes are applied to the latest version on the main branch.

Do not report security vulnerabilities in a public issue.

Use the repository's Security tab and select Report a vulnerability to send a private report. If private vulnerability reporting is not enabled, contact the repository owner privately through their GitHub profile.

Include:

• the affected file or endpoint;
• steps to reproduce the problem;
• the potential impact;
• a minimal proof of concept, when safe; and
• a suggested fix, if available.

Do not access other people's information, disrupt the service or publish the vulnerability before the maintainer has had reasonable time to respond.