Security fixes are released for the latest minor version only. While the module is below 1.0.0, upgrade to the latest release to receive fixes.

Report vulnerabilities privately through GitHub: open a draft security advisory. Do not open a public issue, pull request or discussion.

Include the affected version, a description of the issue and its impact, and steps or code to reproduce it. You will get an acknowledgement within five working days. Once a fix is released, the advisory is published with credit to the reporter unless you prefer otherwise.