Shamoo is pre-1.0 and has no production release yet. Security fixes are applied to the latest release line once releases begin; older pre-1.0 versions are not supported.

Do not open a public issue. Use GitHub's private vulnerability reporting for this repository. Include affected versions or commit, reproduction steps, impact, and any suggested mitigation. Maintainers should acknowledge a complete report within five business days and coordinate disclosure after a fix is available.

Never include credentials, private data, or active exploit targets in a report. Good-faith research that avoids privacy violations, service disruption, and data destruction is welcome.