Ember is pre-1.0 and moves quickly. Security fixes are only guaranteed for the latest released version.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report privately via GitHub Security Advisories for this repository.

Please include a description of the vulnerability and its potential impact, steps to reproduce, and the Ember version or commit hash affected.

We will acknowledge reports within a few days and aim to ship a fix or mitigation before any public disclosure. Please give us a reasonable window to respond before disclosing publicly.