Please report security vulnerabilities using GitHub's private vulnerability reporting feature.

This creates a confidential report that is only visible to the repository maintainers and allows us to coordinate a fix before public disclosure.

If you are unable to use GitHub's private reporting feature, you may instead contact the development team confidentially via Discord by sending a direct message to @brain in the DPP server

We aim to investigate and remediate reported vulnerabilities within 30 days where possible. Once a fix has been released in a supported version, the vulnerability will be disclosed publicly.