Please report vulnerabilities privately through GitHub's Report a vulnerability button on this repository's Security tab, not in a public issue. Include the package, its version and the steps to reproduce.

You'll get an acknowledgement within five business days. Fixes are released for the latest minor version of each package.

The packages here handle signing keys and verify vendor callbacks. Reports about timing, replay, token forgery or anything that leaks a secret or personal data into logs or exceptions are especially welcome.