This project is under active development. Security fixes are applied to the current main branch and the latest published release only.

Do not disclose suspected vulnerabilities in a public issue. Use GitHub's Security → Report a vulnerability form for this repository. Private vulnerability reporting is enabled for this repository.

Include the affected revision, relevant file paths, reproduction steps, impact, and a minimal proof of concept where safe. Remove credentials, private source, and personal data before submitting a report.

We aim to acknowledge a report within 48 hours, provide a status update within seven days, and resolve critical issues within 30 days where practicable.

The extended project policy is documented in SECURITY.adoc.