Security fixes are released for the latest version of wisegate and wisegate-core only.

Please do not open a public issue. Report vulnerabilities privately by email to me@davlgd.com.

Include the affected version or commit, the mode (strict or permissive) and environment variables, the exact request, expected and observed behaviour, and a reproducer if you have one. .oss-scanner/threat_model.md describes what is in scope and how severity is rated.

Fixes are published in a new release, with a GitHub security advisory for confirmed vulnerabilities.