Security fixes are applied to the latest published release and the master
branch. Older releases may require an upgrade.
Do not disclose a vulnerability in a public issue. Use the repository's private security advisory form and include:
- the affected version and platform;
- clear reproduction steps;
- the expected impact;
- any suggested mitigation.
You should receive an acknowledgement within seven days. Please allow time for a fix and coordinated release before publishing details.