Please report security vulnerabilities privately via GitHub's private vulnerability reporting on this repository. Do not open a public issue.

Include:

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Any potential mitigations you have identified

Prior to v1.0.0 we will work with researchers individually on timelines. After v1.0.0 we will have a standardized response timeline.

• Critical: Remote code execution, authentication bypass, or data exfiltration without user interaction
• High: Denial of service with amplification, privilege escalation, or significant data exposure
• Medium: Denial of service requiring sustained effort, information disclosure of limited scope
• Low: Issues requiring unlikely configurations or minimal impact

We consider security research conducted in good faith to be authorized. We will not pursue legal action against researchers who follow this policy and report findings responsibly. We appreciate the effort you put into keeping this project secure.