My repositories are personal projects; there is no money to pay any bug bounties.

If you'd like to report a security issue anyway, I'm very grateful.

Please submit it as a ticket in Issues. Feel free to encrypt it if you want privacy, my public key is available on Keybase or on my personal site.

You can use the Keybase native crypto (good if you don't have a key yourself, as you can encrypt to me using the website without one) or GnuPG. Please include a link to (or export of) your public key if you use GnuPG.