Report vulnerabilities in the affected package's Security → Report a vulnerability page, if enabled.

Otherwise, use the contact details on envoy1084's profile or ask for a private channel. Do not post exploit details publicly.

Include the package version, impact, environment, and a minimal reproduction. Remove credentials and personal data.

Supported versions are listed by each package. This policy does not promise an audit or a response deadline.