Security fixes are applied to:

• the latest tagged release
• the main branch

Older releases may not receive backports.

Please do not open a public issue for suspected security problems.

Use one of these channels instead:

• GitHub Security Advisories for this repository

Include:

• a clear description of the issue
• affected files, versions, or commits
• reproduction steps or a proof of concept
• impact assessment

I will acknowledge receipt as soon as practical, investigate, and work on a fix before public disclosure.

Please give me reasonable time to validate the report and ship a fix before sharing details publicly.

Once a fix is available, I may publish a summary so users know they should update.