We welcome security disclosures and are committed to providing prompt attention to any confirmed security issues.
Vulnerabilities should be reported privately via GitHub Security instead of as a public issue.
We do not yet offer a bounty program for responsible disclosure of security vulnerabilities, however, we do track contributions and record them in the Commonware Library.