Report suspected vulnerabilities privately to dmytro.kulyk@sapient.pro. Please avoid public issues or pull requests that disclose an unpatched vulnerability.

Include the affected package version, runtime, a minimal reproduction, and the expected security impact. For parser issues, include input and chunk boundaries, selectors, and relevant options. Remove credentials and other sensitive data.

Reports are assessed by the maintainers. A fix and any public advisory will be coordinated with the reporter where possible. Response and remediation times are not guaranteed.

Report issues affecting the latest stable release. Reports for older versions and prereleases are also welcome; include the exact affected version. A fix may require upgrading to the latest stable release.