Only the latest release receives security fixes.

Please do not open a public issue for security problems.

Report it privately through GitHub: open the Security tab of this repository and click Report a vulnerability. Include:

• the affected version or commit
• steps to reproduce, or a proof of concept
• the impact you expect, such as credential exposure or code execution

The project is maintained by Andrea Grandi, who handles all security reports.

• I will acknowledge your report within 7 days.
• I will confirm whether the issue is valid and share a plan for a fix within 14 days.
• Once a fix is released, I will publish a GitHub security advisory and credit you, unless you prefer to stay anonymous.

Please give me 90 days to release a fix before you disclose the issue publicly.

In scope: code in this repository and the release builds published from it.

Out of scope: automated scanner output without a working exploit, social engineering, and issues in third-party services or dependencies that are not caused by how this project uses them. Please report those to the upstream project.