Please do not report security vulnerabilities through public issues, discussions or Slack.
Report them privately through the Security tab of the affected repository, under Report a vulnerability:
If you can't use GitHub, email info@tedi.ee.
Include as much of the following as you can:
- affected package and version
- description of the vulnerability and its impact
- steps to reproduce or a proof of concept
- a suggested fix, if you have one
The TEDI team confirms receipt, investigates and keeps you updated. The fix is prepared privately and released as a new package version. A security advisory is then published on GitHub, which reaches consumers through npm audit and Dependabot.
Security fixes are made to the versions listed in Supported versions.