Please report suspected vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for a vulnerability or include credentials, cookies, authentication tokens, private URLs, or personal data in a report.

Include the affected Flow version, operating system and architecture, reproduction steps, impact, and any known mitigations. You should receive an acknowledgment within seven days. Public disclosure should wait until a fix or coordinated disclosure plan is available.

Only the latest released version and the current default branch receive security fixes.