Please report vulnerabilities privately: this repo's Security tab → Report a vulnerability. If that's unavailable, contact @teglsbo directly via GitHub.

Include a minimal reproduction and the version/commit affected. Vulnerabilities in a dependency (Microsoft.PowerPlatform.Dataverse.Client, MarkMpn.Sql4Cds.Engine, DuckDB) should generally be reported upstream instead.

This project is pre-1.0, with a single maintained line (main).