Use GitHub's private vulnerability reporting from this repository's Security tab. Do not disclose suspected vulnerabilities in public issues.
Include the affected revision, reproduction, and impact. Test only systems you
own or have permission to test. Security fixes target the latest main; there
is no paid bounty or LTS branch.