Security fixes are best-effort for the latest development line and the latest published release.
Please avoid posting sensitive details in a public issue.
Recommended order:
- Use GitHub's private vulnerability reporting for this repository if it is enabled.
- If private reporting is not available, open a GitHub Discussion or Issue with a minimal description and without secrets, tokens, cookies, or account identifiers.
- affected version or commit
- operating system
- reproduction steps
- impact summary
- whether credentials, tokens, or local files are exposed
Do not include any of the following in public reports:
- API keys
- OAuth refresh tokens
- session cookies
- full request logs containing secrets
- local config files with credentials
If you accidentally committed or exposed a secret, rotate it first and then report the incident.