Do not open a public issue for a security problem.

Send a private report to chris@todie.io. Include:

• what you found;
• the steps to reproduce it;
• the version or commit;
• the effect you expect.

You can also use the GitHub private vulnerability report for this repo, if it is enabled.

• We acknowledge a report as soon as we can. This repo sets no fixed response time.
• We tell you our plan after we reproduce the problem.
• We credit you in the changelog if you want, after the fix ships.

Only the latest release on main gets security fixes.

If you find a secret in the repo or its history, report it as a vulnerability. Treat the secret as compromised. The owner rotates it.