Security fixes are made on main and included in the next release. Only the latest release receives security updates.

Please report suspected vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for an undisclosed vulnerability.

Include the affected version or commit, reproduction steps, expected impact, and any suggested mitigation. Please avoid accessing data that is not your own or disrupting services while investigating.