We release patches for security vulnerabilities. Which versions are eligible for receiving such patches depends on the project's current version:

If you discover a security vulnerability, please report it by using GitHub's Security Advisory feature:

1. Go to the repository's Security tab
2. Click on "Advisories"
3. Click "New draft security advisory"
4. Provide detailed information about the vulnerability

Please do not report security vulnerabilities through public GitHub issues.

When reporting a vulnerability, please include:

• Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

• We will acknowledge receipt of your vulnerability report within 48 hours
• We will provide a more detailed response within 7 days
• We will work to fix the issue as quickly as possible
• We will keep you informed of our progress

For users of our projects:

• Keep your dependencies up to date
• Use the latest stable version
• Enable security features when available
• Follow secure coding practices
• Review our security advisories regularly

We appreciate security researchers who responsibly disclose vulnerabilities. With your permission, we will:

• Acknowledge your contribution in the release notes
• Credit you in the security advisory

Thank you for helping keep our projects and users safe!