Please report vulnerabilities privately, not in a public issue, pull request or discussion.

Use GitHub's private vulnerability reporting on the affected repository: open its Security tab and choose Report a vulnerability. If you are not sure which repository is affected, report it on stackorder/stackorder.

The stackorder/stackorder security policy covers the supported versions, what to include in a report, what is in scope and what happens next.