Thank you for helping keep Development Seed's open source projects and their users safe.

If you believe you've found a security vulnerability in one of our projects, please report it privately using one of the following:

• GitHub Private Vulnerability Reporting (preferred): Go to the repository's Security tab and click Report a vulnerability. See GitHub's guide to privately reporting a security vulnerability for details.
• Email: security@developmentseed.org

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Helpful reports usually include:

• The affected project and version(s)
• A description of the vulnerability and its potential impact
• Steps to reproduce, or a proof of concept
• A suggested fix or mitigation, if you have one — this is always welcome!

We will review your report, and if necessary, work on a fix or mitigating steps. We'll keep you informed of the outcome.

We're happy to credit you for your disclosure in the published advisory or release notes. Let us know how you'd like to be credited, or if you'd prefer to remain anonymous.

Please do not disclose the vulnerability publicly until it has been resolved. Once we have either (a) released a fix, or (b) let you know we've decided not to address it, you are free to disclose it publicly.