Please don't report security problems in public issues, pull requests or discussions.

Report them privately through GitHub instead: open the affected repository's Security tab and choose Report a vulnerability. The report reaches the maintainers only, and we can work on a fix and an advisory together with you before anything is public.

Include what you can of:

• the affected repository and version (a release tag or a commit),
• what an attacker can do, and under which conditions,
• the steps, input or configuration that reproduce it.

We aim to reply within a week. Once a fix is released we publish a GitHub security advisory, credit you unless you'd rather not be named, and request a CVE where one applies.

Fixes go into the latest release of each project; there are no maintained older release lines. A repository whose own SECURITY.md says otherwise takes precedence over this file.