# Security policy
Please report suspected vulnerabilities privately through GitHub's security
advisory interface. Do not open a public issue for an unpatched vulnerability.
Include affected versions, impact, reproduction steps, and any suggested
mitigation. Never include live CAPTCHA credentials or user tokens. Maintainers
will acknowledge the report and coordinate disclosure after a fix is available.