Use GitHub's private Report a vulnerability form. Include the affected SDK version or commit, reproduction steps, impact, and relevant deployment settings with credentials and private data removed. Please keep exploit details out of public issues while a report is being investigated.

Check whether an issue is still present on the latest release. Older releases do not have a guaranteed security backport schedule. Report suspected vulnerabilities even if you cannot reproduce them on the latest release.

The Weir application listener uses plaintext gRPC; restrict its network access.