daymath is a pure calendar-math library (no network, no eval of untrusted code paths beyond parsing day strings). Still report anything that could cause unexpected code execution or severe resource abuse.

Please use GitHub Security Advisories for this repository:

https://github.com/leemr/daymath/security/advisories/new

Do not open a public issue for sensitive reports. You can expect an acknowledgment when the report is seen; fix timelines depend on severity and maintainer availability.