Security fixes are provided for the latest version on the main branch. Older versions may not receive updates.

Please do not report security vulnerabilities through public GitHub issues.

Instead, use GitHub Private Vulnerability Reporting (preferred).

When reporting, include:

• A description of the issue
• Steps to reproduce
• Affected version or commit
• Potential impact (if known)

We aim to:

• Acknowledge reports within 72 hours
• Investigate and validate the issue
• Coordinate a fix before public disclosure

We appreciate responsible disclosure and thank everyone who helps improve the security of Soterios.