Security fixes are made on the latest release of the current major version of SignedChannel. Please upgrade to that before reporting, in case the issue has already been fixed.

Please do not report security vulnerabilities in public issues, pull requests or discussions.

Report them privately through GitHub instead: Report a vulnerability (Security tab → Report a vulnerability).

Please include:

• the affected package version(s),
• a description of the issue and its impact,
• steps to reproduce, or a proof of concept,
• any suggested fix or mitigation.

The report is visible only to you and the maintainer. You'll get a reply in the advisory. Once a fix is released, the advisory is published with credit to you, unless you'd prefer not to be named.

Dependabot alerts and automated security updates are enabled on this repository, so vulnerable dependencies are flagged and patched automatically.