To report a vulnerability, use this repo's Report a vulnerability form (Security tab → Advisories). We aim to acknowledge within 72 hours.

Please do not file public issues for security reports.