Please don't open a public issue for security problems.

Instead, report them privately using GitHub's private vulnerability reporting, or contact the maintainer through shabbirjamal.com.

Include as much as you can:

• What the issue is and what an attacker could do with it
• Steps to reproduce, or a proof of concept
• Which part is affected (client, Node relay or C++ engine)

You should get a reply within a few days. Once a fix is ready, you'll be credited in the release notes unless you'd rather stay anonymous.

Only the latest code on main receives security fixes.