The latest master branch and the most recent tagged release receive security updates.

Do not report vulnerabilities via public GitHub issues.

Please use one of:

1. GitHub Security Advisories (preferred): open a private advisory at https://github.com/AstroAir/react-quick-starter/security/advisories/new
2. Email: send details to astro_air@126.com with subject prefix [security].

Include:

• A description of the vulnerability and its impact
• Steps to reproduce
• Affected versions / commit SHA

We aim to acknowledge reports within 7 days and to disclose / patch within 90 days. Critical issues may be fast-tracked.