Report vulnerabilities privately via GitHub Security Advisories on the affected repository, or email tj@f00.sh.

Do not open public issues for unfixed security bugs.

We aim to acknowledge reports within a few business days.