Email gabejar@usa.com with details and a proof of concept if available. Please do not open a public issue for security reports. Expect an acknowledgement within 72 hours.

See THREAT_MODEL.md for trust boundaries and the things this project explicitly does not defend against.

The latest released minor version receives security fixes.