Please do not open a public issue for a security problem.

Report it privately through the Security tab of the affected repository ("Report a vulnerability"), or, if that is not available there, get in touch via our website.

Include what you found, which repository and version it affects, and how to reproduce it. We aim to acknowledge reports within a week and will keep you updated while we work on a fix.

Our packages are developed in the open and fixes land on main. Unless a repository says otherwise, only the latest release is supported.