Security fixes are provided for the latest release on the default branch. Older releases are not patched separately — upgrade to the latest version to receive a fix.

Report suspected vulnerabilities privately. Do not open a public issue, pull request, or discussion for a vulnerability that has not been fixed yet.

Two private channels are available:

• GitHub private vulnerability reporting — open this repository's Security tab and choose Report a vulnerability.
• Email — security@sebastian-software.de.

Include a concise description, the affected version or commit, reproduction steps, the impact you expect, and any suggested fix. Leave out credentials and data you are not allowed to share.

Maintainers aim to:

• Acknowledge a private report within 7 days.
• Assess severity and affected versions within 14 days.
• Coordinate a fix and a disclosure timeline with the reporter.
• Credit the reporter when desired and appropriate.

Timing can vary for low-impact reports and for reports that depend on a fix in an upstream dependency.

In scope: anything in this repository that lets someone read, modify, or execute something they should not — including the released artifacts and the build and release automation.

Usually out of scope: reports without a concrete impact path, vulnerabilities in third-party dependencies used as documented, and problems that require an already-compromised machine or a deliberately corrupted local state.