Please report security issues privately through GitHub Security Advisories.

Do not open a public issue for vulnerabilities that could put plugin developers or end users at risk.

You should hear back within 7 days. If a fix is confirmed, we will publish a patched release and credit reporters who want to be named.