Do not report security vulnerabilities in public issues, discussions, or pull requests.
Email bernard@ngandu.dev with:
- the affected package and version;
- a description of the vulnerability and its impact;
- reproduction steps or a proof of concept;
- any suggested mitigation, if available.
You should receive an acknowledgement within five business days. We will coordinate disclosure and remediation with you. Please allow a reasonable amount of time for a fix before publishing details.
Only supported releases are eligible for security fixes. Support information is documented in each package's README or release notes.