Please report security issues privately, through this repository's Security tab -> Report a vulnerability. Do not open a public issue for anything exploitable.

Include what you did, what happened, and what you expected. A proof of concept helps and is not required.

An acknowledgement, then an assessment of severity. Anything in these classes is fixed and released before it is discussed publicly:

• destroys -- data is gone with no copy anywhere
• discloses -- something private leaves the machine
• containment -- code reaches outside the directory it was given

This project runs inside a developer's session with access to their files and their credentials. Reports about that boundary are in scope and are taken seriously, including ones where the failure needs an unusual configuration to reach.