Security Policy

Reporting a Vulnerability

Please do not open a public issue for security vulnerabilities.

Instead, use GitHub's private vulnerability reporting:

1. Go to the repository's Security tab.
2. Click Report a vulnerability under "Advisories".
3. Fill in the details (impact, reproduction steps, affected versions).

This opens a private advisory visible only to maintainers until a fix is ready. We will acknowledge reports as soon as possible and coordinate a disclosure timeline with you.

See GitHub's docs for more detail: https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability