Only the latest release of our repositories receives security fixes.

Please do not report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately through GitHub "Report a vulnerability" into "Security and quality" tab.

Please include:

• the version of the software and how it was installed (binary, Docker image, go install)
• the affected component (executor, assertion, test suite parsing, ...)
• steps to reproduce, ideally a minimal test suite file
• the impact you observed or expect

• We acknowledge your report.
• We keep you informed of the progress towards a fix.
• Once a fix is released, we publish a GitHub security advisory and credit you, unless you prefer to stay anonymous.