Security updates are provided for the latest released version only. If there are no releases, the latest commit on the default branch is considered supported.

Please report security issues privately.

Preferred option:

• Open a private GitHub Security Advisory (if the repository is hosted on GitHub).

If that is not available, open a public issue and request a private channel for disclosure.

Please include:

• Affected version or commit
• Impact and severity
• Steps to reproduce (or a proof of concept)
• Any suggested fix or mitigation

We aim to acknowledge receipt within 5 business days and will work with you to resolve the issue promptly.