We take the security of this package seriously and appreciate responsible disclosure.

Please do not open a public issue for security reports.

Report a vulnerability privately through GitHub's "Report a vulnerability" button on this repository's Security tab (Security → Advisories → Report a vulnerability). This opens a private channel with the maintainers.

We aim to acknowledge your report within 5 business days and to keep you informed as we investigate and prepare a fix.

The latest released version receives security updates. Older versions are supported on a best-effort basis.

Once a fix is available we coordinate a disclosure timeline with you and credit you for the finding, unless you prefer to remain anonymous.