Security fixes target the latest main revision. Update self-hosted installations before checking whether a reported issue still applies.

Use GitHub's private vulnerability reporting. Include the affected revision, reproduction steps, impact and any suggested fix. Use dummy credentials and remove personal information from logs or screenshots.

Do not include credentials, private server addresses or exploitable vulnerability details in public issues. If private reporting is temporarily unavailable, open an issue asking for a private contact channel without including the vulnerability details.

For ordinary bugs and feature requests, use the public issue tracker.