Report vulnerabilities privately through GitHub private vulnerability reporting. Do not open a public issue or discuss the problem on Discord.

Include what you found, how to reproduce it, and which branch or version is affected. You will receive an acknowledgement within seven days and updates as the report is triaged and fixed. Credit is given in the advisory unless you ask otherwise.

No version is supported yet. Security support starts with the first tagged release from main.

Earlier code under archive/* and the published 0.0.x packages are not maintained and receive no security fixes.