Please do not open a public issue, discussion or pull request for a security problem. Report it privately instead: open this repository's Security tab and choose Report a vulnerability. The reply comes through the same private advisory.

A useful report says what you found, how to reproduce it, and what someone could do with it.

Fixes land on the main branch. Older snapshots are not patched.

This policy covers the code in this repository. A vulnerability in a dependency belongs to that project, but please report it here as well if it affects this one.