Please report security vulnerabilities via GitHub Security Advisories:

• Open a private security advisory
• For sensitive issues, contact the repository owner directly

Latest main branch. Older versions are not supported.

We follow coordinated disclosure with reporters. Once an issue is patched, an advisory will be published.

Rust projects in this org enforce a zero-advisory floor via deny.yml workflow (Monday cron + on-demand) plus audit.yml (rustsec/audit-check, Wednesday weekly).

Static analysis runs Tuesday weekly via codeql-rust.yml workflow.