Please report suspected vulnerabilities privately to david.oravsky@gmail.com. Include the affected package and version, a small reproduction, the impact, and any workaround you have found. Keep credentials and personal data out of the report.

Please wait to open a public issue until we have discussed disclosure. For ordinary bugs and usage questions, see Support.

Include whether the issue also occurs on the latest stable release so we can identify which versions are affected.