Security fixes are applied to the latest version on the default branch.

Please report vulnerabilities privately through the repository's GitHub security advisory page. Do not open a public issue until a fix is available.

Include a concise description, reproduction steps, the affected files or versions, and the expected impact. You may use redacted logs or a minimal test case, but never include CAPTCHA API keys, session cookies, credentials, solutions from paid tasks, or data from websites you are not authorized to test.

You should receive an acknowledgement within seven days. We will investigate the report, keep you updated when practical, and coordinate disclosure after a fix is ready.

Reports about this repository's code and dependency use are in scope. Service-side API issues and vulnerabilities in third-party CAPTCHA providers should be reported to their respective owners.