Security fixes are provided for the latest released major version. Older versions may receive fixes at the maintainers' discretion.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, report them privately through GitHub's private vulnerability reporting: go to the repository's Security tab and click "Report a vulnerability".

If you cannot use that channel, email security@pleaseai.dev instead.

Please include:

• A description of the vulnerability and its impact
• Steps to reproduce, or a proof of concept
• Affected versions, and any known mitigations

• We aim to acknowledge your report within 72 hours.
• We will keep you informed of progress toward a fix and may ask for additional detail.
• Once a fix is released, we will credit you in the advisory unless you prefer to remain anonymous.

We ask that you give us a reasonable opportunity to address the issue before any public disclosure.