If you discover a security vulnerability in this project, please report it privately rather than opening a public issue.
Contact: @rdwj
When reporting, please include:
- A clear description of the issue
- Steps to reproduce, if applicable
- The affected version(s) or commit hash
- Any mitigation or workaround you have identified
We will acknowledge your report within 5 business days and work with you on a reasonable disclosure timeline. Please give us an opportunity to investigate and patch before public disclosure.
| Version | Supported |
|---|---|
| latest | ✅ |
| older | Best-effort |
This policy covers vulnerabilities in the code and configurations maintained in this repository. Issues in upstream dependencies should be reported to those projects directly.
We appreciate responsible disclosure. If you would like to be credited in the release notes for a fix, let us know in your report.