Security fixes target the latest released version on the default branch (main).
Older major versions receive fixes only when explicitly maintained.
Do not open a public GitHub issue for security problems.
Email william@theesfeld.net with:
- A short description of the issue
- Steps to reproduce or a proof of concept
- Affected version or commit
- Impact assessment if known
You will receive an acknowledgment when the report is received. Please allow reasonable time for investigation before any public disclosure.
- Private report first
- Coordinated public disclosure after a fix or mitigation is available
- Credit for the reporter on request
Use the repository issue tracker for ordinary bugs and feature requests.