Security fixes are applied to the latest version on the default branch.

Please do not open a public issue for a suspected vulnerability.

Use GitHub’s private vulnerability reporting feature for this repository. Include the affected component, reproduction steps, impact, and any suggested mitigation. Please allow reasonable time for investigation before public disclosure.

Do not include API keys, credentials, private user data, or other secrets in a report unless they are required to demonstrate the issue and are transmitted through the private reporting channel.