Only the latest release of each gem gets security fixes. Upgrade before reporting if you can.

Please do not open a public issue. Report it privately from the repository's Security tab (Report a vulnerability), or email clement@levups.com if you cannot.

Tell us what an attacker can do, which versions are affected, and how to reproduce it: a template, a PDF, a user agent string, a few lines of Ruby. We are two maintainers: expect an answer within a week, and a fixed release as soon as we have one. We credit you in the advisory and the changelog, unless you would rather we did not.