Report security vulnerabilities via GitHub private advisories: https://github.com/matthewjhunter/herald/security/advisories/new
Please include a description of the issue, steps to reproduce, and any relevant details about impact.
We aim to respond within 72 hours of receiving a report.
Do not open public issues for security vulnerabilities.