Security Policy

Supported Versions

Security updates are provided for the latest minor version on main. Older tagged releases are not patched in place; upgrade to the latest release.

Please report security issues privately via GitHub's security advisory flow:

We aim to acknowledge reports within 72 hours and triage within one week.

Do not open public issues, pull requests, or discussions for sensitive findings. Coordinated disclosure timelines are agreed case-by-case.