Security fixes are applied to the latest version of the main branch.

Please don't report security vulnerabilities through public issues, discussions or pull requests.

Report them privately through GitHub: open the Security tab of this repository and click Report a vulnerability, or go straight to the advisory form.

Please include as much of the following as you can:

• the type of issue and where it is (file, function, endpoint)
• the steps or a proof of concept to reproduce it
• the impact you think an attacker could achieve

You should get an acknowledgment within 7 days. You will be kept informed while the issue is investigated and fixed, and credited in the release notes unless you prefer to stay anonymous.