We release updates on the main branch. Please use the latest version for security patches.

If you discover a security vulnerability in this project:

1. Do not open a public issue.
2. Contact the maintainers
3. Provide as much detail as possible:
   • Steps to reproduce
   • Affected commit(s) or version(s)
   • Potential impact

We aim to respond within 72 hours, confirm receipt, and keep you updated throughout remediation.

We appreciate responsible disclosure. Please allow us time to fix issues before making them public. Contributors who report valid security issues may be credited in the release notes.

• Always update to the latest release
• Avoid committing secrets or tokens
• Run tests (npm test) after upgrading dependencies
• Use commitrix validate in CI/CD pipelines