Do not open a public issue. Use the private GitHub security advisory form and include this information:
- The affected version or commit
- The impact
- The reproduction steps
- A suggested mitigation, if you have one.
We will acknowledge the report within five business days. We will keep the report private during validation and repair. We will agree with you on a disclosure date. Do not access data that is not yours. Do not disrupt an active service during your investigation.