Do not report security vulnerabilities in public issues, discussions or pull requests.

Report them privately through GitHub: open the affected repository's Security tab and choose Report a vulnerability. Include the affected version, the platform, a description of the impact, and the steps or input that reproduce it.

If you cannot use GitHub, email support@rawframe.net with "Security" in the subject; do not include exploit details until we reply with a private channel.

You will get an acknowledgement within seven days. We will keep you informed while we investigate and fix the issue, and credit you in the advisory unless you prefer otherwise.

Security fixes are made for the latest release of each project. Before a project reaches 1.0.0, only its newest minor version receives fixes.