Reporting a vulnerability

Report a flaw privately, through GitHub’s private vulnerability reporting: the Security tab of the repository, then Report a vulnerability. Please do not open a public issue for it.

What counts

A flaw is anything that breaks the promise: an attacker achieving something the promise says they cannot. What the threat model lists as outside the promise is not a flaw, though a report that something should move inside it is welcome as an ordinary issue.

What is supported

Only main is supported. There is no bug bounty.