Email opensource@simtabi.com with a description of the issue, the affected version, and steps to reproduce. Please do not open a public issue for a security report.

You will receive an acknowledgement within three working days. We aim to ship a fix, or a documented mitigation, within 30 days of confirming the report, and will credit you in the release notes unless you ask otherwise.

While the package is pre-1.0, only the latest tag receives security fixes.