Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than opening a public issue.

Include the steps to reproduce the vulnerability and its potential impact. You can expect a first response within a week.

Only the current main branch gets security fixes.