The table explains which versions are currently being supported versus not.

To report possible security vulnerabilities with supported versions, please use our official GitHub security page.

This is the quickest and easiest way to report possible security vulnerabilities and get the attention of developers working on the project.

Security vulnerability reports are triaged with within 48 hours of being reported to determine legitimacy. If a vulnerability is determined to be legitimate (e.g. not falsified or spurious) you can expect to receive updates on the investigation and efforts to remediate the issue every 24 hours after the initial triage completion.

If your report is accepted you will be credited as the reporter and an advisory will be issued.

If your report is declined no advisory will be issued and no further action will be taken.

If you submit multiple reports that are found to not be legitimate this will result in investigation into your reporting patterns. If there is a consistent pattern of abusive reporting you will be banned from participation in the project (reporting security vulnerabilities, filing issues, opening pull requests, etc.). In extreme cases you will be banned from participation in any repository under the root account/organization this repository lives beneath.