Please do not report security vulnerabilities in public issues.

Report them privately through GitHub: open the affected repository, choose Security, then Report a vulnerability. Include the affected version, a description of the issue, and steps to reproduce it.

We acknowledge reports within three working days, keep you informed while we investigate, and credit you in the release notes unless you prefer otherwise.

Bever is pre-1.0. Security fixes are released for the latest minor version.