Report a vulnerability privately through GitHub's private vulnerability reporting. Open the new advisory form, or open the repository's Security tab and select Report a vulnerability. Never report a vulnerability in a public issue.

Include the version you used, the input that triggers the problem, and what happens.

The latest 4.x release is the supported version. Fixes ship as a new 4.x release, not as a patch to an older one.

You get a first response within 7 days. We confirm the problem, work on a fix, and keep you updated in the advisory. We disclose the vulnerability after a fix ships. The advisory is published with the release that fixes it, and credits you unless you ask otherwise.