Security fixes are provided for:

Please do not open public issues for security vulnerabilities.

Report privately by email:

• [email protected]

Include:

• affected version/commit
• clear reproduction steps
• impact assessment
• proof-of-concept (if available)

You can expect:

1. Acknowledgement within 7 days.
2. Triage and severity assessment.
3. Coordination on a fix and disclosure timeline.

When possible, we will publish a patched release and note the fix in the changelog.