Weave is pre-1.0. Security fixes land on main and ship in the next release of the @weaveio/* packages. Only the latest published release is supported.

Please do not open a public issue for security problems.

Report vulnerabilities privately through GitHub: Report a vulnerability.

Include what you can of:

• the affected package(s) and version(s)
• steps to reproduce, or a proof of concept
• the impact you expect

We aim to acknowledge reports within a few business days and will keep you updated while we work on a fix. Once a fix is released, we publish an advisory and credit the reporter unless you ask us not to.