Report vulnerabilities privately through GitHub's "Report a vulnerability" button on this repository's Security tab. Do not open a public issue.
We acknowledge reports within five working days. Fixes ship as a new release tag; the advisory is published with the release.