Report security issues privately.

Do not open a public issue. Use GitHub's private security report:

1. Go to security advisories.
2. Click Report a vulnerability.
3. Include steps to reproduce and the impact.

• Privilege escalation
• Credential leaks
• Unsafe package operations
• Code injection

• Homebrew issues — report to Homebrew
• Third-party packages — report to the maintainer
• System libraries — report upstream

• Acknowledge: 5 business days
• Fix: 30 days

• We publish an advisory
• We update the changelog
• We notify users

Tell us if you want credit.

Open a public issue.