Please report security vulnerabilities privately to hello@builtnorth.co.

Do not open a public issue or pull request for a suspected vulnerability — a public report gives every site running this package a window of exposure before a fix is available.

Include whatever you have: affected version, a description of the issue, and steps to reproduce it. A proof of concept helps but is not required.

• Acknowledgement within 3 business days.
• An assessment — whether we can reproduce it, and our view of the severity — within 10 business days.
• Updates as a fix progresses, and credit in the release notes if you would like it.

Security fixes are released for the latest minor version. Older versions are not patched; upgrade to receive them.