Report vulnerabilities privately through this repository's Security > Report a vulnerability page. Do not open a public issue containing exploit details, credentials, access IDs, device/product keys, emails, UIDs, passwords, tokens or authKey values. The same private channel accepts rights-holder concerns.

If a credential was exposed, revoke or rotate it immediately. Deleting a comment or commit does not revoke a secret. Privately report the location, not the secret itself, so maintainers can coordinate removal.

No runtime release exists yet. Once published, security fixes will target the latest stable minor release.