To report a vulnerability open an issue. You can expect an answer in 1-3 days.

If the vulnerability can be fixed by updating a dependency or with a manual patch, PRs are always welcome! If no PR is submitted, I’d be happy to address it myself.

For vulnerability reports, here’s what to expect:

• Updates will be provided as we work on the issue.
• If the vulnerability is accepted, we'll prioritize a fix and inform you of the progress.
• If the vulnerability is declined, we'll explain why and provide guidance if applicable.

Feel free to submit your report, and thank you for contributing to the project's security!