Security fixes are applied to the latest code on main. This project has not yet published a stable major release.

Please do not disclose vulnerabilities in public issues, discussions, or pull requests. Use GitHub private vulnerability reporting and include:

• the affected page, feature, or commit;
• steps to reproduce or a proof of concept;
• the potential impact; and
• any suggested mitigation.

You should receive an acknowledgement within seven days. We will investigate, coordinate a fix and release, and credit reporters when requested. Please allow reasonable time for remediation before public disclosure.