The current release and the main branch are supported. Older tags are not maintained, and fixes are not backported to them.
Please do not open a public issue.
Report privately to sohilmomin2000@gmail.com, or use GitHub's private security advisory on this repository (Security → Report a vulnerability). A private advisory is preferred: it keeps the report, the fix and the release in one place.
Please include:
- what the issue is, and which version or commit it affects;
- the steps to reproduce, or a proof of concept;
- the impact you believe it has;
- any suggested fix.
| Stage | Target |
|---|---|
| Acknowledgement | within 48 hours |
| Initial assessment | within 7 days |
| Fix for a critical issue | within 30 days |
| Public disclosure | coordinated with you, after a fix ships |
This is a single-maintainer project, so these are targets rather than a contract. If a report goes unanswered for a week, send a reminder to the same address.
In scope: the code in this repository, as distributed.
Out of scope: third-party dependencies (report those upstream), the hosting provider, social engineering, physical access, and denial of service by traffic volume.
Testing must not access, modify or retain another person's data. If you encounter personal data while testing, stop and tell me.
I will not pursue legal action against a researcher who reports in good faith, within this scope, and without privacy harm or service disruption.
With your permission I credit reporters in the release notes.