Report suspected vulnerabilities privately through GitHub's private vulnerability reporting: the Report a vulnerability button under this repository's Security tab, or this link.

Please do not open a public issue, pull request or discussion for a security report. Anything posted publicly is visible to everyone before a fix is available.

If you cannot use GitHub's reporting, contact us and ask for a private channel. Do not include the details in that first message.

• The version, tag or commit you tested
• What an attacker can do, and what they need first
• Steps to reproduce, or a proof of concept
• Any suggested fix, if you have one

We will acknowledge your report, keep you updated while we investigate, and credit you in the advisory when it is published unless you would rather we did not.