Security Policy

Report vulnerabilities privately to the maintainers. Do not open public issues for security-sensitive disclosures.

Reporting

Use GitHub Security Advisories for this repository, or contact the maintainer through the profile linked from the repository homepage.

Out of scope: third-party services you operate separately, and issues that require uploading DRM-protected content.

We aim to acknowledge reports within 7 days and provide a fix or mitigation plan for confirmed issues as soon as practical.