Report vulnerabilities privately to security@hexproof.dev. Please do not open a public issue for an unfixed defect. Include a description, a reproducer or proof-of-concept, and the affected version or commit.

You can expect acknowledgment within 72 hours, a fix for valid issues, and credit if you want it.