Please do not report security vulnerabilities through public issues, discussions or pull requests.

Report them privately through GitHub instead: open the repository's Security tab and choose Report a vulnerability (GitHub's private vulnerability reporting). The report is visible only to the maintainers, and a fix can be prepared in a private fork and published as a security advisory.

If that is not possible, email [email protected].

Include what you can of: the affected project and version, the steps to reproduce, and the impact you expect.

Fixes are released for the latest version of each project only. Upgrade to the latest release before reporting, if you can.