Email security@piqueld.dev. Don't open a public issue or pull request for a vulnerability, and don't disclose it publicly until a fix is released.

Include what you found, how to reproduce it, the piqueld version or commit, and what an attacker could do with it.

Security fixes go into the latest release, as a patch release, and into main. piqueld has no stable 1.0 release yet, so older minor versions don't receive fixes: upgrade to the latest one.