Supported version: the latest published release on the default branch. Older archive versions may not receive fixes.

Please do not post exploit details, credentials or private data in a public issue. If GitHub private vulnerability reporting is enabled, use Security → Report a vulnerability on this repository. Otherwise, open a public issue asking for a private reporting channel without disclosing the vulnerability. The maintainer will coordinate a private report.

Useful reports include the affected version, impact, safe reproduction steps and any proposed fix. Do not test against someone else's deployment without permission. Local green tests are not an independent security certification.