Broccoli holds employee data, so we take security reports seriously and thank everyone who sends one.

Please do not open a public issue, discussion or pull request for a security problem.

Report it privately instead: open the Security tab of this repository and choose Report a vulnerability. Only the maintainers can see the report.

Please include:

• what is affected and how it can be exploited
• steps to reproduce, or a proof of concept
• the version or commit you tested

We aim to acknowledge a report within three working days and to keep you updated until it is fixed. Once a fix is released we publish an advisory and, if you wish, credit you for the find.

Broccoli is not yet released. Until the first release, fixes land on main only.