Please do not open a public issue for security bugs.
Privately report them via one of:
- GitHub Security Advisories — the "Report a vulnerability" button on the repository (available on GitHub Free for public repositories), or
- Email
cluciani@gmail.com(PGP optional, plain text is fine).
Include, if possible:
- Affected version / commit
- Steps to reproduce
- Impact
You can expect an acknowledgment within 3 business days.