Security fixes are handled on the main branch and the latest published @martian-engineering/lossless-claw release line.

Older release lines are not guaranteed to receive security fixes unless a maintainer explicitly announces support for that line in a release note or advisory.

Please do not report suspected vulnerabilities in public GitHub issues, discussions, pull requests, or social channels.

Use GitHub's private vulnerability reporting flow for this repository:

1. Open the repository's Security tab.
2. Select Report a vulnerability.
3. Include affected versions, reproduction steps, impact, and any proof of concept details that are safe to share privately.

If the private reporting flow is unavailable, contact a repository maintainer through an existing trusted private channel and include only a high-level, non-sensitive request for security coordination in any public follow-up.

Maintainers aim to acknowledge new reports within 5 business days. After triage, maintainers will coordinate validation, remediation, release timing, and public disclosure through the private advisory thread when possible.

Good-faith security research is welcome when it avoids privacy violations, service disruption, data destruction, and access to data that does not belong to you. Reports should include only the minimum sensitive detail needed to validate the issue.