Security fixes are provided for the latest release and the default branch. Older releases are not supported. Upgrade before reporting an issue that may already be fixed.

Do not open a public issue, pull request, or discussion for a suspected vulnerability.

Use either private channel:

• GitHub Security Advisories. Open a private report from this repository's Security tab, Report a vulnerability. This is the preferred channel.
• Email. jechenmailman@gmail.com, with a subject line that begins with [SECURITY].

Include the affected version, platform, impact, and steps to reproduce. Do not attach credentials, tokens, or unredacted logs.

The maintainers aim to acknowledge a report within 5 business days, and to coordinate a fix and disclosure within 90 days. There is no bug-bounty promise.

Other frameworks are started as argument lists, with the shell off. Do not enable shell execution of a user string.

Keep Jupyter and similar tokens in the environment. Do not write them into logs or into files that are committed.