Read the security model for threats, trust boundaries, keys, review evidence and failure handling.

Use the published releases to identify released versions, their exact source and documented fixes. The main branch may contain unpublished changes. This page does not promise a support period for any release.

Use GitHub's private vulnerability reporting channel if it is enabled for this repository. Otherwise, ask the maintainer for a private reporting channel before sharing sensitive details.

Include the affected release or commit, the affected component, expected behavior and observed impact. Do not put credentials, private data or executable exploit instructions in a public issue. Ordinary non-sensitive defects can use GitHub issues.