Security fixes are applied to the latest version on the main branch. There are no separately maintained release branches yet.

Please do not open a public issue for a vulnerability. Use GitHub's private vulnerability reporting to contact the maintainers privately. Include the affected commit or version, impact, reproduction steps using a local fixture where possible, and a suggested fix if available. Do not include credentials or unrelated third-party scan data.

We aim to acknowledge a report within five business days and provide status updates as we investigate. Response times may vary. Please allow maintainers reasonable time to reproduce, fix, and coordinate disclosure before publishing technical details.

If private reporting is unavailable, contact @DevCop95 privately on GitHub and request a secure channel. Do not send sensitive details in a public issue or discussion.