My repositories are personal projects; there is no money to pay any bug bounties.

If you'd like to report a security issue anyway, I'm very grateful.

Please submit it as a ticket in Issues. Feel free to encrypt it if you want privacy, my public key is available on Keyoxide. Please include a link to (or export of) your public key.