Please don't report security vulnerabilities in public issues, pull requests or discussions.

Report them privately through GitHub instead: open the affected repository's Security tab and choose Report a vulnerability. GitHub's guide to private vulnerability reporting walks through the form.

A useful report includes:

• the affected repository, and the version or commit
• steps to reproduce
• what an attacker could do with it

We'll reply in the advisory thread and keep you posted there while we work on it, including which versions a fix will cover. Let us know whether you'd like to be credited if we publish an advisory.