quic-zig is not production-ready, and in its current state it is not considered safe: expect security bugs, and don't expose it to untrusted peers where that matters.

For now, report vulnerabilities as ordinary public issues. Say what triggers the problem and what happens, with a reproduction if you have one.

Once the project reaches a more mature state, reports will move to GitHub's private vulnerability reporting, and this file will say so.