Only the latest released version of each package is supported. Please update to it and check whether the problem persists before reporting.

Do not open a public issue.

Report it privately instead, by either:

• the repository's Security tab → Report a vulnerability, which opens a private advisory only the maintainer can see, or
• email to info@michael-becker-berlin.de.

Please include the package and version, what an attacker can do, and the smallest steps that reproduce it.

You can expect an acknowledgement within 72 hours.

Once a fix is released, the issue is disclosed in a GitHub security advisory, crediting the reporter if they wish to be named.