Security fixes are applied to the latest release and the current main branch. Older tags are not maintained unless a release note says otherwise.

Do not disclose a suspected vulnerability in a public issue, discussion, or pull request.

Use GitHub private vulnerability reporting and include:

• The affected route, component, or deployment configuration
• Reproduction steps or a minimal proof of concept
• The likely impact and required preconditions
• Any suggested mitigation

Maintainers will acknowledge a complete report, validate its scope, coordinate a fix, and credit the reporter when requested. Response times depend on severity and maintainer availability; the advisory remains private until a coordinated disclosure is agreed.

Reports about authentication, tenant isolation, evidence access, billing webhooks, outbound integrations, secrets, and production deployment defaults are in scope. Reports that only affect locally modified environments or unsupported third-party services may be closed with an explanation.