Security fixes are applied to the latest code on main.

If you find a security issue, please use GitHub's private reporting flow:

1. Go to the repository's Security tab.
2. Click Report a vulnerability.
3. Include clear reproduction steps and impact.

If private reporting is unavailable, open an issue with minimal details and request a private follow-up.

• Initial acknowledgement: within 7 days
• Triage and severity assessment: within 14 days
• Fix timeline: based on severity and exploitability