Please do not open a public GitHub issue for security vulnerabilities.

Instead, report vulnerabilities privately via GitHub Security Advisories or by emailing the maintainer directly (see the package author metadata).

We aim to acknowledge reports within 72 hours and to provide an initial assessment within 7 days.

Once a fix is released we will publish a security advisory and update this policy with the CVE details.