Please report security issues privately, never in a public issue:

• GitHub private vulnerability reporting: the "Report a vulnerability" button on this repository's Security tab.
• Email: support@didit.me, with "Security" in the subject.

Include the SDK version, a description of the issue and the steps to reproduce it. Never send real API keys, webhook secrets, tokens or personal data; use synthetic values.

We acknowledge reports within three working days and keep you informed until a fix is released. Only the latest released version receives security fixes.