Security fixes target the latest release and the main branch. Older releases should be considered unsupported unless a maintainer explicitly says otherwise.

Please report suspected vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for an undisclosed vulnerability.

Include the affected version or commit, reproduction steps, impact, and any suggested mitigation. Remove live credentials, personal data, and unrelated sensitive information from the report.

Maintainers will acknowledge the report, validate its impact, coordinate a fix, and publish disclosure details when a safe release is available.