Security fixes are released from the latest version on the main branch. Update to the newest release before reporting a vulnerability that may already be fixed.

Do not report vulnerabilities in a public issue.

Use GitHub's Report a vulnerability form in the repository's Security tab to open a private security advisory. Include the affected version, impact, reproduction steps, and any proposed remediation.

If private vulnerability reporting is unavailable, contact the repository owner through their GitHub profile without including sensitive details in the initial message.

You should receive an acknowledgement within seven days. Release timing depends on severity and whether coordinated disclosure is required.