Security fixes are applied to the latest release and the main branch.

Please do not disclose suspected vulnerabilities in a public issue, discussion, or pull request. When the repository's Security tab offers Report a vulnerability, use it to open a private report with the maintainer. If private reporting is unavailable, open a minimal issue that requests a private contact channel without including vulnerability details.

Include the affected endpoint or component, reproduction steps, potential impact, and any suggested mitigation. You can expect an acknowledgement within five business days. Status updates will follow as the report is validated and a remediation plan is prepared.

Avoid accessing data that is not your own, disrupting a deployed service, or performing denial-of-service testing while investigating a report.