Security fixes are provided for the latest release on the main branch.

Do not open a public issue for an undisclosed vulnerability. Use GitHub's Report a vulnerability flow in the Security tab of this repository to submit a private security advisory.

Include the affected commit/version, reproduction steps, expected impact and any suggested mitigation. Do not include credentials or data that you are not authorized to share.

The maintainer will acknowledge the report, assess severity, coordinate a fix and publish disclosure details after users have had a reasonable opportunity to update. Reporter credit is optional.

Reports about SSRF bypasses, redirect/DNS rebinding, response-budget bypasses, authentication mistakes, secret disclosure, unsafe XML/HTML handling and dependency vulnerabilities are especially useful. General SEO disagreements or target-site availability problems should use normal issues.

See the security model for architecture, residual risks and deployment guidance.