Only the latest release receives security fixes.

Report vulnerabilities privately via GitHub security advisories. Do not open public issues for security reports.

Include the affected version, reproduction steps, impact, and any suggested mitigation. Do not include credentials or other secrets that are not required to reproduce the issue.

You will receive an initial response within 7 days. The report will be validated, its impact assessed, and the next steps shared through the private advisory. If the report is accepted, a fix will be prepared for the latest release and a disclosure timeline will be coordinated with the reporter.

Please allow a fix to be released before public disclosure. When appropriate, the project will publish a GitHub security advisory after the fix is available. Reporters will be credited in the advisory with their consent.