Please don't open a public issue for security problems. Use GitHub's private vulnerability reporting instead. Include steps to reproduce and the affected file or commit.

We aim to reply within 5 business days. Fixes go to main; there are no maintained release branches.

If you find a leaked credential in this repo's history, report it the same way so it can be rotated.