For vulnerabilities in this independently maintained fork, use GitHub's private vulnerability reporting. Include the affected commit, reproduction steps, and impact. Do not include real OAuth tokens, document contents, or other credentials in a public issue.

The fork maintainer coordinates reports for changes maintained here. This fork does not promise a Google Security Team response or a fixed response time.

For vulnerabilities also affecting the original project, follow the upstream security policy.