figure follows semantic versioning. Security fixes are made on the latest release of each module; older releases are not patched.

Please do not open a public issue for a security problem.

Report it privately through GitHub's private vulnerability reporting form. That opens a draft advisory only the maintainers and you can see.

What helps most: the affected module and version, a description of the impact, and the smallest input or program that reproduces it.

You can expect an acknowledgement within seven days and a status update at least every fourteen days until the report is resolved. When a fix ships, the advisory is published with credit to the reporter unless you ask otherwise.

figure renders charts from data a program hands it. The things worth reporting are the ones where that data crosses a trust boundary: a malformed or hostile data set that causes a panic in a decoder, an out-of-bounds access, unbounded memory growth, or output that escapes its encoding — SVG or PDF that breaks out of the document it is written into. Rendering that is merely ugly or wrong is a normal bug; open an issue for it.