The latest main branch and the currently supported NixOS unstable toolchain receive security fixes. Older revisions are not supported.

Do not open a public issue. Submit a report through GitHub private vulnerability reporting. If that form is unavailable, contact the maintainer through the private address listed on the GitHub profile and request an encrypted channel.

Please include the affected commit or version, the relevant host or module configuration, impact, and a minimal reproduction. Do not include live secrets or private identities in a report.

We aim to acknowledge reports within 3 business days, provide an initial assessment within 7 business days, and agree coordinated disclosure timing with the reporter. Good-faith research that avoids privacy violations, persistence, destructive actions, and third-party systems is welcome.