-If you find a security vulnerability in an open source project, always follow a [responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure) policy. If the project as a method for reporting security vulnerabilities privately, use that to work with the maintainers to issue a fix. If a method for privately reporting doesn't exist, do your best to privately contact the maintainers. E.g., check the `git log` for emails. Make a pull request fixing the problem or file an issue on the repository as a last resort!
0 commit comments