Please do not report security vulnerabilities in public issues.
Report them privately through GitHub: open the affected repository, go to Security → Report a vulnerability, and describe the issue with steps to reproduce.
We aim to acknowledge reports within 3 days and to share a fix plan within 14 days. We will credit you in the release notes unless you ask us not to.
Security fixes are released for the latest minor version of each project.