Please do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting for this repository. Include the affected revision, reproduction steps, impact, and any suggested mitigation. We will acknowledge a complete report as soon as practical and coordinate disclosure after a fix is available.

The benchmark data is public and the production application has no accounts or product database. Reports about data accuracy or upstream methodology are not security vulnerabilities and can use a normal issue.