Security

Reporting a vulnerability

Report a vulnerability through GitHub's private vulnerability reporting: the Security tab of this repository, Report a vulnerability. The report reaches the maintainers only. Do not open a public issue for it.

You get an acknowledgment within three business days and a first assessment within ten. A confirmed vulnerability is fixed in the supported versions and published as a GitHub security advisory, with credit to the reporter unless they prefer none. Disclosure is coordinated: ninety days after the report, or earlier once the fix is released.

Supported versions

The latest release and the main and develop branches. Older releases receive no fixes.

Scope

The code in this repository. A vulnerability in software this repository packages or vendors belongs to that project's process; report it here as well when the packaging makes it worse or when it is exploitable only through this repository.