Report vulnerabilities privately through GitHub private vulnerability reporting. Do not open a public issue.

Include the affected version or commit, operating system and architecture, the smallest input or sequence that reproduces the issue, its observed impact, and any known mitigation. The maintainers aim to acknowledge a report within seven days and will communicate the assessment and remediation plan through the private advisory. Coordinated public disclosure follows release of a fix or an agreed disclosure date. Reporters are credited unless they request otherwise.

pypulseqpp is pre-1.0. Security fixes land on the default branch and are included in the next release; older releases and backport branches are not maintained.