There is no production release yet. Security fixes will target the default branch until a supported release policy is published.

Please report security issues privately. Use this repository's private vulnerability-reporting flow when it is enabled, or contact the maintainer through a previously established private channel.

Do not open a public issue containing:

• credentials or access tokens;
• private proxy lists or customer data;
• API keys, cookies, or signing secrets;
• exploitable infrastructure details, internal addresses, or hostnames;
• unredacted logs or request headers.

Include a concise impact statement, reproducible steps, affected versions or commits, and a safe proof of concept when available. Redact all secrets and personal data.

The maintainer will acknowledge the report, validate impact, coordinate remediation, and agree on disclosure timing. Do not publish details before a fix or mitigation is available.