Security fixes are made against the latest released version of rapidfuzz-collections. Older releases do not receive backported security fixes.

Users of older versions should upgrade to the latest release.

Do not report suspected security vulnerabilities through public GitHub Issues or Discussions.

Please use GitHub Private Vulnerability Reporting to report potential security vulnerabilities.

When possible, include enough information to reproduce and assess the issue, such as:

• the affected rapidfuzz-collections version;
• a description of the vulnerability and its potential security impact;
• a minimal reproducer or proof of concept;
• relevant environment or dependency information;
• any known workarounds or mitigations.

Please avoid publicly disclosing the vulnerability until it has been investigated and, where appropriate, a fix has been released.

Security vulnerabilities in third-party dependencies should be reported to the maintainers of the affected dependency.

If a dependency vulnerability also requires a change to rapidfuzz-collections, such as updating a dependency constraint or applying a project-level mitigation, it may also be reported privately to this project.