Support begins only after the project publishes a release policy. Until then, use the latest default-branch revision when evaluating a potential vulnerability.

Use GitHub private vulnerability reporting from the repository's Security tab when it is available. Include affected revisions, impact, reproduction conditions, and a minimal proof of concept without unrelated personal or secret data.

If private vulnerability reporting is unavailable, do not open a public issue with vulnerability details. Use a private channel listed on the maintainer's GitHub profile to request a safe reporting path, without including exploit information in the first message.

The project does not promise a response or remediation service level. Maintainers will assess reports according to available evidence, impact, and project capacity.