Security fixes target the current main branch and latest public beta until a versioned support policy is published.

Do not open a public issue containing vulnerability details, exploit code, credentials, private filesystem paths, or personal media information.

Use the repository's Security page and select Report a vulnerability. Private vulnerability reporting is enabled and sends the report privately to the maintainer through a GitHub repository security advisory.

No dedicated security email has been established, and this policy deliberately does not publish or invent one. If GitHub's private reporting button is temporarily unavailable, open a public issue containing only a request for a private reporting route—do not include sensitive details.

• affected revision or version;
• impacted component and environment;
• minimal reproduction or proof of concept;
• expected and actual security impact;
• known mitigations; and
• whether credentials or private user data may have been exposed.

Sanitize unrelated data. Please allow the maintainer reasonable time to confirm, fix, and coordinate disclosure before publishing details.