Security

Found a vulnerability?

We welcome reports from the security community. The more specific you are, the faster we can triage. Please give us a reasonable chance to fix issues before disclosing them publicly.

What to include

What you found, steps to reproduce, affected URLs, what data or behaviour is impacted, and your contact details if you'd like a reply.

What to expect

Reports go directly to the maintainer. We read every one and follow up on credible findings. Use this form or email [email protected], both reach the same inbox.

Disclosure policy

Please give us reasonable time to investigate and fix issues before sharing them publicly. We don't run a formal bug bounty, but we appreciate responsible disclosure and may offer a discretionary thank-you for significant reports.