Security fixes go into the latest release. Please update before reporting.

Please do not open a public issue. Report it privately through GitHub: Security → Report a vulnerability on Mrcoloo/scriptorium-library.

Include what you found, how to reproduce it, and the version you tested. You will get an answer as soon as possible; once a fix is released the advisory is published with credit, unless you prefer to stay anonymous.

If the problem is also present in Calibre-Web-Automated, mention it so it can be coordinated with the upstream project.

How Scriptorium is hardened: docs/security.md.