Security fixes are applied to the most recent minor release line on master. Older majors are best-effort only; please upgrade to receive patches.

Please do not open a public GitHub issue for security reports. They are indexed by search engines as soon as they appear, which often defeats the point of responsible disclosure.

Instead, use one of the following private channels:

• GitHub's Private Vulnerability Reporting (preferred).
• Email the maintainer at the address listed on the GitHub profile.

When you report, please include:

1. A description of the vulnerability and its impact.
2. Steps to reproduce, ideally a minimal proof of concept.
3. The affected version, environment and config.
4. Whether you have a suggested fix.

We will credit reporters in the release notes unless you ask to remain anonymous.

This boilerplate ships with the controls listed in wiki/instructions.md. If you find one of those controls is not actually enforced in code, that is a security bug — please report it via the channels above.