Security fixes target the latest 3.0.x release and current main. Older releases are retained for reference; upgrade to the complete current bundle before reproducing a report.

Use GitHub's private vulnerability reporting to report security issues privately.

Please don't open a public issue for anything you suspect is a security problem.

You'll get a response once the report is triaged, and credit if you want it.