Please do not report security vulnerabilities through public GitHub issues.

Report them privately using GitHub's private vulnerability reporting (Security tab → "Report a vulnerability"), or email support@cloudsmith.io.

You will receive a response as quickly as possible. Please include enough detail to reproduce the issue, and allow time for a fix before any public disclosure.