Security fixes are made on the main branch.

Please do not open a public issue for a vulnerability. Use GitHub's private vulnerability report and include:

• the affected part (engine, renderer, measure scripts or site);
• a minimal reproduction;
• the impact you observed; and
• any suggested mitigation.

You should receive an acknowledgement within seven days.