Please report security issues through private vulnerability reporting, not in public issues. Include the affected version and steps to reproduce the problem.

Bogform is a hard fork and does not automatically receive fixes from OpenTofu, so advisories published by that project are checked and any relevant fixes are applied here by hand.