Please use GitHub's private vulnerability reporting for the public YueduCoreText repository. Do not publish exploit details in a public issue. Include the affected version, Apple platform version, reproduction steps, and impact. Maintainers will acknowledge a complete report within seven days.

YueduCoreTextTypography performs no networking, persistence, analytics, or telemetry. It does not access publication files by itself. Consumers own all input, resource loading, logging, and storage.

Security updates are released on the newest supported 0.x line. This policy is not a promise of support for unpublished branches or modified distributions.