Security fixes are applied to the latest main branch and the most recent tagged release. Older releases may not receive fixes.

Please do not disclose exploitable details in a public issue. Use GitHub's Report a vulnerability flow on the repository's Security tab. If private reporting is unavailable, open a minimal issue asking for a private contact channel and avoid including proof-of-concept code or sensitive data.

Include the affected version or commit, a concise impact description, reproduction steps, and any suggested mitigation. We will acknowledge reports as soon as practical and coordinate a fix and disclosure timeline with the reporter.