Please do not open a public issue for security vulnerabilities.

Email info@gaitco.com with:

• the package and version affected
• a description of the issue and its impact
• steps to reproduce, if you have them

We aim to acknowledge reports within 3 working days and to ship a fix or a mitigation plan within 30 days. We will credit you in the release notes unless you would rather stay anonymous.

Security fixes land on the latest released major version of each package. Older majors are supported only where the fix is a clean backport.