Report vulnerabilities privately through GitHub's "Report a vulnerability" button on the repository's Security tab. Do not open a public issue.

Expect an acknowledgement within 7 days. Fixes ship in a patch release of the latest minor version.

Scope notes: --nvda-allow-eval lets test code run arbitrary Python inside NVDA by design; enable it only for trusted tests.