Please report suspected vulnerabilities privately through GitHub Private Vulnerability Reporting. Do not open a public issue for a suspected vulnerability or include credentials, customer data, signed URLs, cookies, tokens, or exploit details in a public post.
The maintainers will acknowledge the report in GitHub, investigate it, and use the advisory to coordinate any fix and disclosure. GitHub is the only supported security-reporting channel for this repository; there is no public security email address.
Only the latest released version is supported with security updates.