Only the latest commit on the default branch is supported for security fixes.
Please do not open public GitHub issues for security problems.
Instead, report vulnerabilities privately using one of the following:
- GitHub Security Advisories (preferred) for this repository
- Direct maintainer contact if advisory tooling is unavailable
Include:
- A clear description of the issue
- Reproduction steps or a proof of concept
- Affected commit/version information
- Any suggested mitigations
We aim to acknowledge reports within 72 hours and provide status updates as we investigate.