Security Policy

Found a security issue? Report it privately. Here's how, and what to expect.

Reporting

Report vulnerabilities privately rather than in public issues, so they can be fixed before disclosure.

Scope & response

Supported versions receive fixes, and reports get an acknowledgement and a path to resolution. Path handling is treated as a security surface. See Paths & Security.