The latest commit on staging receives security patches. Patches are promoted to main through the next release cycle.

Do not open a public GitHub issue for a security vulnerability. Report it privately through the repository's Security tab, GitHub security advisory flow, or the private contact method listed on the repository page.

Include the affected version or commit, impact, reproduction steps, relevant logs, and suggested mitigation when possible.

Maintainers will acknowledge receipt, provide an assessment timeline, coordinate a fix, and agree with the reporter on responsible disclosure. Public disclosure should occur only after a fix or mitigation is available.

This policy covers the code, configuration, dependencies, workflows, and generated artifacts maintained in this repository. Review Security / Dependency Audit results for supported ecosystems. Never commit credentials, tokens, private keys, or sensitive environment files. Report accidental secret exposure privately and rotate the credential immediately.