PyMediate follows ZeroVer and stays pre-1.0 (0.x) indefinitely. Security fixes are made against the latest release on the main branch; older 0.x releases are not backported.

Please report security vulnerabilities privately rather than opening a public issue.

Preferred: use GitHub's private vulnerability reporting for this repository (Security tab → Report a vulnerability). This opens a private discussion with the maintainer and lets us coordinate a fix before any public disclosure.

If you're unable to use that, open a regular issue asking to be contacted privately and we'll follow up.

This is a solo-maintained open source project — there's no formal SLA, but reports are taken seriously and acknowledged as soon as possible. Once a fix is available, it will be released and credited in the release notes (unless you'd prefer to stay anonymous).