Older minor or patch versions on a still-supported major receive fixes on a best-effort basis; we recommend upgrading to the latest published version within each major.

Please report security issues privately, not in public issues. Two options:

1. Use GitHub's Report a vulnerability feature on the repository's Security tab.
2. Email kaveh.razavi@gmail.com with subject [VMx security].

You will receive an acknowledgement within 72 hours. Coordinated disclosure timelines are negotiated case-by-case.