Report security issues through GitHub. If the issue can be described publicly without exposing users to immediate risk, open an issue and link to a pull request.

If the vulnerability is very serious, email mojibake@zaerl.com before making the report public.

Security reports should include enough detail to reproduce the problem. The reporter should provide a pull request with a focused unit test that demonstrates the problem. The test should fail before the fix and pass after the fix.

If publishing the test or reproduction steps would disclose an unpatched vulnerability, open a private security advisory first and coordinate with the maintainers before submitting the pull request publicly.

I prefer all communications to be in English.