Carbon is pre-1.0. Security fixes are made against the latest tagged release and the current main branch. Older releases are not supported.

Do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting page:

https://github.com/Chrrxs/carbon/security/advisories/new

If that page is unavailable, contact the repository owner privately through their GitHub profile before sharing sensitive details. Include the affected version, impact, reproduction steps, and any suggested mitigation. Please keep the report private until a fix or coordinated disclosure plan is ready.

For ordinary crashes, incorrect behavior, and non-sensitive hardening ideas, use the public bug-report form instead.