Please do not open a public issue for security vulnerabilities.

Report them privately to hello+security@bnf.events. Include a short description and steps to reproduce if you can. We’ll respond as soon as we can and will coordinate any fix and disclosure with you.

For more details see .well-known/security.txt.