This project does not currently publish versioned releases. Security fixes are developed against the latest revision of main; earlier revisions are not maintained as separate supported lines.

Report vulnerabilities through GitHub private vulnerability reporting. Do not open a public Issue or Discussion for a suspected vulnerability.

Include the affected revision and component, the expected impact, and the smallest safe reproduction you can provide. Do not include unrelated credentials, personal data, customer data, or production data.

Reports are coordinated through the private security advisory. This project does not promise a fixed response time. Public disclosure should be coordinated in the advisory and normally follows an available fix or mitigation.