Reporting a vulnerability

Report privately to the maintainers rather than in a public issue. Include what you observed, how to reproduce it, and the version. We will confirm receipt, agree a disclosure timeline, and credit you unless you prefer otherwise.

One class of report we treat as more serious than a missing control: a claim in this document that turns out to be false — a mechanism that does not enforce what it says it does. A gap we have documented is a known risk you can plan around; a gap you believed was covered is not. We will correct the document in the same change as the code.

---