Security fixes are currently provided for the latest 0.0.x branch and main.

Please do not report security vulnerabilities through public GitHub issues.

Use GitHub Security Advisories for private disclosure:

• Report a vulnerability

When reporting, include:

• Affected component(s) and version/commit
• Reproduction steps or proof-of-concept
• Impact assessment
• Suggested mitigation (if known)

• We will acknowledge new reports as soon as possible.
• We will validate and triage the report.
• We will coordinate remediation and disclosure timing with the reporter.

If a report is accepted, we will prepare a fix and document it in CHANGELOG.md.