Please do not open a public issue for a security problem.

Report it privately through GitHub instead: Report a vulnerability

Include what you found, how to reproduce it, and what an attacker could do with it. You will get an answer as soon as possible, and the fix will be published together with a security advisory that credits you, unless you prefer otherwise.

Security fixes are made on the latest version in the main branch. Please update to it before reporting.

Never commit tokens, API keys or passwords. Keep them in your environment or an ignored config file. If a secret was ever pushed, revoke it and create a new one: removing it from the code is not enough.