Report security vulnerabilities privately through the vulnerability report form on GitHub. Do not report vulnerabilities in public issues or pull requests.

The maintainers publish a GitHub security advisory and a RustSec advisory for each fixed vulnerability.