Report vulnerabilities privately through GitHub private vulnerability reporting: open the Security tab of the affected repository and choose Report a vulnerability. The report reaches the maintainers only.

Do not open a public issue, pull request or discussion for a vulnerability: that discloses it before a fix exists.

Include what you found, how to reproduce it, and the version or commit you tested.

Spinbox is experimental. Only the latest release receives security fixes. Releases are tagged by date, for example v20261024.01; a fix ships in a new release, not as a patch to an older one.