Security fixes target main and, when practical, the latest published release. Older releases are not supported.

Do not open a public issue, pull request, or discussion for a suspected vulnerability.

Use GitHub's Report a vulnerability form. If the form is unavailable, contact the maintainer through the GitHub profile without sharing vulnerability details publicly.

Include the affected version or commit, impact, reproduction steps, and any known mitigation. Remove unrelated secrets and personal data.

Expect acknowledgement within three business days and an initial assessment within seven. Fix and disclosure timing depends on severity and complexity. Give maintainers time to coordinate both.