Please don't report security vulnerabilities through public GitHub issues, discussions or pull requests.

Report them privately through GitHub: open a private security advisory. Include what you found, how to reproduce it, and its impact. We'll acknowledge it, keep you updated and credit you in the advisory unless you prefer otherwise.

This covers the code in this repository and the @perf-profiler/* npm packages. For Flashlight Cloud (app.flashlight.dev), use the same channel.