Security fixes are applied to the latest commit on main. Port Grove does not currently maintain older release branches.

Do not report suspected vulnerabilities in a public issue. Use GitHub's Report a vulnerability option in the repository Security tab to open a private security advisory.

Include the affected component, reproduction steps, expected impact, and any suggested mitigation. Remove real passwords, enrollment tokens, session cookies, IP addresses, hostnames, and database contents from the report.

You should receive an initial response within seven days. No bug bounty or response-time guarantee is currently offered.