Only the latest release on nuget.org receives fixes.

Report privately through GitHub security advisories. Do not open a public issue.

Include the input that triggers it, the platform and the package version. Expect a first reply within a week.

A bug in URL parsing itself, where Ada.Url and upstream Ada give the same wrong answer, belongs upstream: ada-url/ada security policy.