Fixes are released for the latest published version of DragoAnt.System.Text.Json.Observer only.
Please report vulnerabilities privately through GitHub: open the repository's Security tab and choose Report a vulnerability (https://github.com/DragoAnt/Extensions.System.Text.Json/security/advisories/new). Do not open a public issue.
Include the package version, the target framework, and a minimal JSON payload plus rules that reproduce the problem. A value that a rule should mask but appears unmasked in the output counts as a security issue.