Security fixes are provided for the latest release and the current default branch.

Please report vulnerabilities privately through GitHub's Security tab by opening a private vulnerability report. Do not open a public issue with exploit details or credentials. Include affected versions, reproduction steps, impact, and any suggested mitigation.

You should receive an acknowledgement within five business days. We will coordinate validation, remediation, release timing, and responsible disclosure with the reporter.