Report it privately through GitHub: Report a vulnerability. Please don't open a public issue, pull request or discussion for it.

Include what an attacker can do, the steps or a test that shows it, and the commit you tested. You'll get a reply within a week. Once a fix is ready we publish an advisory and credit you, unless you'd rather not be named.

Only master receives fixes. The legacy-2022 tag marks the 2022 layout with the October 2026 security fixes applied; it gets no further changes, so projects built on it should apply future advisories by hand.

This is a template: code you generated from it is yours to patch. Watch the repository's security advisories to hear about problems in code you copied.