If you believe you have found a security vulnerability, let us know right away. We investigate all legitimate reports and do our best to fix the problem quickly.

Use private vulnerability reporting: open the repository's Security tab and click Report a vulnerability. Please do not open a public issue for a suspected vulnerability.