Security fixes are applied to the latest public beta and the master branch.

Report vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for an unpatched credential, request-routing, logging, or data-exposure problem.

Include the affected version, provider, configuration, reproduction steps, impact, and any known mitigation. An initial response is expected within seven days.