Security fixes are applied to the latest version on the main branch.

Please do not open a public issue for a suspected vulnerability. Use the repository's private vulnerability reporting page instead.

Include the affected version, operating system, reproduction steps, expected impact, and any suggested mitigation. You should receive an acknowledgment within seven days. Please allow reasonable time for investigation and a coordinated fix before disclosure.