Drever is pre-1.0 and changes quickly. Security fixes target the latest published release and the current main branch.

Please do not open a public issue for a suspected vulnerability.

Use GitHub private vulnerability reporting when it is available. If that route is unavailable, email i@zhuo.dev.

Include the affected package and version, a minimal reproduction, the expected impact, and any known mitigations. We aim to acknowledge a complete report within seven days and will coordinate disclosure after a fix is ready.