The latest GitHub release is supported. Pre-release source snapshots receive no separate security support.

Use the repository's private vulnerability reporting. Include the affected version, reproduction input, impact, and a proposed fix if known. Do not open a public issue for an unpatched vulnerability.

Ordinary malformed-input errors and infeasible trips are not vulnerabilities; use a normal issue for those.

Normal operation reads one local UTF-8 JSON file and writes text. It performs no network requests, loads no plugins, executes no input, and has no runtime dependencies. Input is capped at 1 MiB before JSON parsing and solver dimensions are capped before exhaustive search.