Report security issues privately, never in a public issue or PR. Use GitHub's private vulnerability reporting (the repository's Security tab → "Report a vulnerability"), or contact the maintainers directly.

Include:

• A clear description of the issue and its impact.
• A reproducible proof of concept against the current code.
• Affected version or commit, and environment.

Reports that appear AI-generated without a verified, reproducible proof of concept will be closed as not actionable. Fabricated or unverifiable reports waste maintainer time, are treated as abuse, and repeat offenders are blocked. (See curl's 2026 decision to end its bug bounty over AI "slop" for why this policy exists.)

Only the latest default-branch code is in scope. There is no paid bounty.