Security fixes are made on the default branch. This project has not yet published a stable compatibility or long-term-support policy.
Use Security → Report a vulnerability in the GitHub repository so details remain private. If private vulnerability reporting is unavailable, open a minimal issue asking the maintainer to establish a private channel; do not include exploit details, credentials, private artifact URLs, or personal data in a public issue.
Include:
- Affected revision and deployment mode
- Reproduction steps or a proof of concept
- Expected and observed impact
- Any suggested mitigation
Do not test against a deployment you do not own or have explicit permission to assess.