Security fixes are applied to the latest released version. Older releases may not receive patches.

Use GitHub private vulnerability reporting. Do not open a public issue.

Include the affected version, impact, reproduction steps, and any suggested remediation. Maintainers aim to acknowledge reports within five business days and will coordinate disclosure after a fix is available.

For general hardening and data handling guidance, see docs/security.md.