Before the first stable release, security fixes are provided only on the default branch. After versioned releases begin, this section must list the supported release lines.

Do not open a public issue containing a vulnerability, credential, transcript, audio sample, temporary download URL, or delivery payload.

Use the repository hosting platform's private vulnerability-reporting feature. If the target platform does not provide one, contact the repository owner through the organization's private security contact before sharing details. The public release is blocked until that contact is configured and verified.

Include the affected version or commit, deployment profile, impact, reproduction steps, and a minimal redacted proof of concept. Maintainers should acknowledge receipt, coordinate disclosure privately, and publish remediation guidance after a fix is available.