Security fixes are made on the latest release of each project (the main branch). Older versions are not patched.

Please do not report security vulnerabilities through public issues, discussions or pull requests.

Use GitHub's private vulnerability reporting instead:

1. Open the repository's Security tab.
2. Click Report a vulnerability.
3. Describe the issue, the affected version, steps to reproduce and the impact you expect.

If that is not possible, email bahriyiilmaz@icloud.com with the subject SECURITY: <repository>.

• Acknowledgement within 3 business days.
• An assessment and a fix plan within 10 business days.
• Credit in the release notes once the fix is published, unless you prefer to stay anonymous.

Every repository has Dependabot alerts, Dependabot security updates, secret scanning and push protection enabled.