Security fixes are applied to the latest released version. Please make sure you are on the most recent release before reporting an issue.
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Instead, report them privately using GitHub's
private vulnerability reporting.
If you are unable to use that, contact a maintainer listed in
.github/CODEOWNERS.
Please include as much of the following as you can:
- The type of issue and the affected component
- Affected version(s)
- Steps to reproduce or a proof of concept
- The potential impact
- We aim to acknowledge a report within a few business days.
- We will keep you informed about the progress towards a fix.
- We ask that you give us a reasonable amount of time to address the issue before any public disclosure, and we will credit you in the release notes if you wish.
Thank you for helping keep this project and its users safe.