Security fixes are applied to the current main branch and the latest release.

Do not open a public issue for a suspected vulnerability.

Use GitHub private vulnerability reporting. Include the affected version, impact, reproduction steps, and any suggested mitigation. Remove credentials, student records, email contents, and other personal data from the report.

The maintainer will confirm receipt, investigate, and coordinate disclosure and remediation through the private advisory.