Report security problems in qed privately, through GitHub's private vulnerability reporting: the Report a vulnerability button on the Security tab of this repository. Please do not open a public issue or pull request for them.

A useful report names the release or commit that is affected, describes how to reproduce the problem, and what an attacker could do with it. The discussion, and any fix, happen on the advisory the report opens, which stays private until the fix is released.

Fixes are made on main and ship in the next release; earlier releases do not receive them.