Security fixes are applied to the latest tagged release and the latest commit on main. Earlier releases, commits, and development branches are not supported.

Use GitHub's private vulnerability reporting: open the Security tab, select Advisories, and choose Report a vulnerability. Do not disclose the vulnerability in a public Issue, pull request, Discussion, or other public channel.

Include the affected component and revision, potential impact, reproduction steps or a proof of concept, and any suggested remediation. Remove credentials, provider transcripts, and unrelated private data from the report.

The maintainer will coordinate remediation and public disclosure through the private advisory.