Please report vulnerabilities privately by email to sergio@gimeno.dev, not in public issues.

Include what an attacker can do, the steps or a proof of concept, and the version or commit you tested. Ghostdrop is maintained by one person in their spare time: expect a reply within a week, and a fix as soon as practical. Only the latest release is supported: fixes are published as a new patch release, and the release notes say when an update is security-relevant.