Please report security vulnerabilities privately — do not open a public issue or pull request for them.

Use GitHub's private reporting flow: Report a vulnerability.

Please include enough detail to reproduce the issue (affected version, a minimal repro or proof of concept, and the impact). You can expect an initial response within a few days. Once a fix is available it will be released to NuGet and the advisory published.

Only the latest 2.x release receives security fixes.