Security Policy

Supported versions

The latest minor release of the package receives security fixes. Older releases should upgrade — the package follows semantic versioning, so upgrades within a major version are non-breaking.

Reporting a vulnerability

Please do not open a public GitHub issue for security problems.

Report vulnerabilities privately via GitHub Security Advisories.

You can expect an initial response within a few business days. Once a fix is released, we credit reporters in the release notes unless you prefer otherwise.