Report vulnerabilities privately through GitHub: on https://github.com/nebari-dev/javo open the Security tab and choose Report a vulnerability. Please do not open a public issue or pull request for it.

Include what is affected, how to reproduce it and what an attacker can do with it. Replies come on the private advisory.

Only the main branch is supported. Fixes land on main; there are no maintained release branches.