Report vulnerabilities privately through GitHub: open the Security tab of this repository and select Report a vulnerability, or email security@pullfrog.com. Do not open a public issue.

Include the affected version, steps to reproduce, and the impact you observed. We acknowledge reports, keep you updated while we fix them, and credit you in the advisory unless you ask us not to.

Fixes ship in the latest pullfrog release on npm and the v0 tag of this action. Older versions do not receive security patches.