Report security issues privately. Do not open a public issue for a security bug.

Use GitHub's private vulnerability reporting to open an advisory: Security advisories. If you cannot use that channel, email support@trmnl.com.

Please include the affected version, a description of the issue, and a minimal reproduction if you have one.

We aim to acknowledge a report within 5 business days and will keep you updated as we investigate. Once a fix ships, we credit reporters who want it.