Contact

A note on security reports

For a security issue in a project, use its published security policy or disclosure contact first. Contact me directly if that route is missing, unreachable or inappropriate for the concern. This includes a reasonable concern that the official route could put people at risk through a compromised maintainer account, malicious contributor activity or a supply-chain attack.

Send only the information needed to establish a reporting path. Please do not send credentials, private user data, malware samples or unpublished exploit details through social platforms. Ordinary bugs and feature requests belong in the project's public issue tracker.