Security fixes are provided for the latest release and the current main branch. Older releases may not receive patches.

Do not disclose suspected vulnerabilities in public issues. Submit a private report through GitHub Security Advisories with reproduction steps, affected versions, and expected impact.

You should receive an acknowledgement within seven days. The maintainer will assess the report, coordinate a fix and release when appropriate, and credit reporters who want public recognition. Please allow time for a patch before public disclosure.

Security reports for bundled Apache or PHP components should also identify the upstream project and relevant CVE when available.