Security
Responsible disclosure
Security is the core of what we do. Please report vulnerabilities privately — never in a public issue.
How to report
Use GitHub's private vulnerability reporting. Include the affected package and version, the impact, and steps to reproduce.
Report a vulnerabilityWhat to expect
- Acknowledgement
- within 3 business days
- Initial assessment
- within 10 business days
- Fix and disclosure
- coordinated with the reporter
Safe harbor
We will not pursue legal action for good-faith research that respects privacy, avoids disruption, never touches funds that are not yours, and gives us reasonable time to respond. Full details are in the security policy.