Please report security vulnerabilities privately through GitHub's private vulnerability reporting on this repository: open the Security tab and choose Report a vulnerability. This opens a private channel monitored by the maintainers.

Do not open a public issue or pull request for a security report — public disclosure before a fix is available puts users at risk.

We will acknowledge your report, coordinate a fix, and credit you (if you wish) when the fix ships.

Security fixes are delivered against the latest released tag. Each fix ships as a new v<VERSION> release with its complete corresponding source published here (AGPL-3.0 §13), so the remedy is always to update to the newest release.