Report security vulnerabilities privately to morton@myma.us, or through GitHub's "Report a vulnerability" button on this repository's Security tab. Do not open a public issue for a vulnerability.

Include the affected version or commit, steps to reproduce, and the impact you expect. You will get an acknowledgement within 7 days. Fixes go to the latest release; older releases are not patched.