Security fixes are released for the latest release only. The package has not had a stable release yet.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests, and do not disclose them publicly until a fix has been coordinated.

Report them privately through GitHub Security Advisories, or by email to the maintainer listed in composer.json.

Please include:

• The affected package version and PHP version.
• A description of the vulnerability and its impact.
• Steps or code to reproduce it.
• Any known workaround.

You will receive a response as soon as possible. Once a fix is released, the vulnerability will be disclosed publicly with credit to the reporter, unless you prefer to stay anonymous.