Reporting vulnerabilities

Please report security issues privately. Don’t open a public issue.

• Use the repository’s private vulnerability reporting (“Report a vulnerability” on the Security tab) for the affected repository.
• Include the affected component and version, reproduction steps, and the impact you observed.
• We acknowledge reports, keep you informed while we investigate and fix, and credit you in the advisory if you wish.

Please don’t access, modify or delete other users’ data, degrade service availability, or test against hardware you don’t own. Good-faith research within these limits is welcome.