Please do not open a public GitHub issue for security problems.

We follow coordinated disclosure. Please give us a reasonable window (typically 90 days) to investigate and release a fix before publicly disclosing the issue.

Researchers who follow this policy and whose report leads to a code change will be credited in the release notes (unless they prefer to remain anonymous).