Please report security problems privately through GitHub's private vulnerability reporting. Do not open a public issue for them.

We will reply within 7 days to confirm that we received your report, and keep you updated until it is fixed.

Only the latest release receives security fixes.

• Code execution, or access to files or the network beyond what the app needs, caused by crafted input or by the app's own code
• A flaw in the build or release workflows that could let an attacker change what is published
• A vulnerable dependency that is reachable from the app