Report vulnerabilities privately, through GitHub: on the repository's Security tab, choose Report a vulnerability (or open a new advisory directly). Only the maintainers can read it. Never put the details in a public issue, pull request or discussion.

Include what you found, how to reproduce it, and which version or commit you tested.

Cortex has no release yet. Reports against the main branch are welcome.