Fixes land on the default branch and in the latest release. Older releases are not patched.
Please report vulnerabilities privately, not in a public issue.
- If the repository's Security tab shows Report a vulnerability, use it. The report stays private between you and the maintainer.
- If it doesn't, open a minimal issue titled "Security contact request" with no technical details, and a private channel will be arranged.
Please include the affected version or commit, a minimal reproduction that uses synthetic data, the impact you observed, and any suggested fix. Don't include real secrets, personal data or working exploit payloads.
These are one-person projects maintained on a best-effort basis, so no response time is guaranteed. Confirmed issues are fixed on the default branch, noted in the CHANGELOG, and credited to the reporter if they wish.
Test only against your own local copy. Don't probe hosted demos or third-party services the projects talk to.