Report a vulnerability through GitHub's private reporting: open the Security tab and choose Report a vulnerability. That opens a private thread with the maintainer. Do not open a public issue for a vulnerability.

If the tab has no Report a vulnerability option, this repository is private and GitHub offers no private reporting on it. Contact the maintainer directly.

Tell us what you can:

• The version or commit you tested.
• What an attacker reaches, and what they need first.
• The steps that reproduce it.

We answer as soon as we can. If a report is valid, we agree a disclosure date with you before we publish anything.