The latest v0.x release line receives security fixes. Pre-1.0, only the most recent minor is supported.

Please report suspected vulnerabilities privately rather than opening a public issue:

• Use GitHub's "Report a vulnerability" (Security → Advisories) on this repository, or
• email krebbekx@gmail.com.

You'll get an acknowledgement within a few days. Please include a description, affected version, and a minimal reproduction if possible.

• GitHub Actions are pinned to commit SHAs and updated via Dependabot.
• Workflows run with least-privilege contents: read permissions and do not persist credentials.
• chronicle has no module dependencies: the root module requires nothing beyond the standard library, so there is no third-party code to pin and no go.sum in the root module.