Security Research

Responsible-disclosure writeups, published only after the affected project has shipped a fix and issued its own public advisory (or explicitly agreed to disclosure). Findings currently under private review are not listed here.

Disclosure policy

• Vulnerabilities are reported privately to maintainers first.
• No technical details are published here until a fix is live and the maintainer has either published a GHSA/CVE or given explicit permission.
• If a maintainer prefers not to disclose publicly, the finding stays private indefinitely -- their call, not ours.

Confirmed findings (fixed & publicly disclosed)

None yet -- check back soon.

Acknowledgments

This section will list official credit from maintainers' own security advisories, once published.