Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities by email to oss@thalesgroup.com, with a description of the issue and steps to reproduce. You can expect an acknowledgement within 5 business days and a status update within 30 days.

If the vulnerability is accepted, a fix will be released as soon as practicable and you will be credited in the release notes (unless you prefer otherwise).

If the vulnerability is declined, we will explain why.

We follow a coordinated disclosure model. Please allow us reasonable time to investigate and release a fix before any public disclosure.