We take security very seriously. We ask everyone follows the
coordinated vulnerability disclosure model, rather than immediately making vulnerabilities public.

If you believe you have discovered a vulnerability please privately contact one of the maintainers via the contact methods on their GitHub profile. Alternatively you may Report a Security Vulnerability privately using the GitHub Security Advisory Reporting beta. In the future we will publish an official email for this purpose.

Users who report bugs will at the discretion of the user be credited for the discovery.

1. User privately reports a potential vulnerability.
2. The maintainers review the report and ascertain if additional information is required.
3. The maintainers reproduce the bug.
4. The bug is patched, and if possible the user reporting the bug is given access to a fixed version or git patch.
5. The fix is confirmed to resolve the vulnerability.
6. The fix is released.
7. The security advisory is published sometime after users have had a chance to update.