Security policy

Mohar decides what agents are allowed to do, so a bug here can widen permissions it shouldn't. Please report anything that looks like one privately.

How to report

Use GitHub's private vulnerability reporting: the "Report a vulnerability" button under the Security tab of this repository. Include what you found, how to reproduce it, and what an attacker could do with it.

You'll get a reply within 7 days. Fixes for confirmed issues are released before details are published, and reporters are credited unless they ask not to be.

Supported versions

Nothing is released yet. Once releases start, the latest minor version gets security fixes.