Security fixes are handled on the default branch until formal releases are published.

Please report security issues privately using GitHub Security Advisories when the project is hosted on GitHub. If advisories are not enabled yet, open a minimal issue asking for a private contact path without disclosing exploit details.

Please include:

• Affected version or commit.
• Steps to reproduce.
• Impact.
• Any suggested fix, if known.

Do not share .env files, SQLite databases, Metron credentials, cached covers, or other personal reading-order data in public issues or pull requests.