Please report suspected security vulnerabilities privately. In the affected repository, open Security, select Advisories, and choose Report a vulnerability. This opens a private report for maintainers to review.

Do not disclose vulnerability details in public issues or pull requests. Never include passwords, access tokens, private keys, personal information, or confidential data in a report. Use redacted examples and synthetic data instead.

Please include:

• The affected repository, version or commit, and relevant configuration.
• A description of the potential impact.
• Reproduction steps or a minimal proof of concept that is safe to run.
• Any suggested mitigation, if known.

Nathan Baker (@sobolevnrm) is the sole security contact. Reports are handled on a best-effort basis; there is no guaranteed response time. Please keep follow-up discussion in the private report rather than posting sensitive details publicly.

If the private reporting button is unavailable, contact @sobolevnrm through a public issue containing only a request to arrange a private reporting channel. Do not include vulnerability details or sensitive information.

Security maintenance generally focuses on current releases of actively maintained projects. Older releases and archived projects have no guaranteed security support. A repository-specific security policy takes precedence over this default policy.

Please allow time to assess the report and coordinate a fix before public disclosure. We aim to agree on disclosure timing with the reporter and offer credit with their consent. No security bounty program is offered.