Security fixes are provided on a best-effort basis for:

• the latest release/tag
• the main branch

Older versions may not receive patches.

Please do not report security vulnerabilities in public GitHub issues.

Use one of these options:

1. Open a private GitHub Security Advisory for this repository (preferred).
2. If private advisories are not available, open a normal issue and request a private contact channel without disclosing exploit details.

• affected version / commit
• impact summary
• reproduction steps or proof of concept
• any suggested mitigation

Maintainers will triage reports on a best-effort basis and may ask for follow-up details before confirming severity or remediation timelines.