Security policy

Reporting a vulnerability

Please report security issues privately and do not open a public issue.

Include what you found, how to reproduce it, and the version or commit you tested. We will acknowledge the report and keep you updated on the fix.

Security fixes land on the develop branch and ship in the next release.

See .oss-scanner/threat_model.md for what is considered in scope and how severity is judged.