Only latest release receives security fixes.

Report vulnerabilities privately through GitHub's Security tab using Report a vulnerability. Do not open public issue.

Include affected version, reproduction steps, impact, and suggested fix when available. Maintainer will acknowledge report within 7 days and coordinate disclosure after fix ships.