Report any possible or confirmed vulnerability through GitHub private vulnerability reporting. Do not put vulnerability details in public issues, discussions or pull requests. Administrator activation of the private channel is a release prerequisite; see activation status and instructions. GitHub sign-in is required for the private reporting channel.

Include the affected commit or release, component, expected boundary and a minimal reproduction using synthetic data. Explain the impact without including credentials, identity documents, biometric samples or actual applicant/personal data. Maintain private communication while maintainers investigate and coordinate disclosure.

Public security-hardening issues are for planned improvements that do not disclose a suspected vulnerability. Use the security-hardening form for that work; use the private reporting link whenever a vulnerability is possible or confirmed.

If the private channel is unavailable, request a private contact from the maintainers without publishing vulnerability details. Repository access and contribution instructions do not change the proprietary license.