Security fixes are applied to the current production release on main.

Do not open a public issue for a suspected security problem.

Use GitHub private vulnerability reporting and include:

• A clear description of the issue
• The affected URL, file, or dependency
• Reproduction steps
• Expected and observed behaviour
• Any suggested mitigation

Please avoid accessing data that is not yours, disrupting the production site, or publishing the issue before a fix is available.

Useful reports include:

• Exposed secrets or private files
• Unsafe dependency behaviour
• Cross-site scripting or content injection
• Incorrect security headers with a practical impact
• Build or deployment configuration that exposes protected data

General content corrections and visual bugs belong in the public issue tracker.