The latest tagged release on the default branch receives security fixes.
Please email security reports privately (do not open a public issue for exploitable bugs). Include:
- Affected version / commit
- Reproduction steps
- Impact (e.g. dual ownership, stale release accepted)
We will acknowledge receipt and coordinate a fix and disclosure timeline.