Only the main branch receives security fixes.

Do not open a public issue. Email the maintainer at mail@mattyeend.co.uk with:

• a description of the issue and its impact,
• steps to reproduce,
• affected versions or commits.

You will receive an acknowledgement within 3 working days and a status update within 10 working days.

In scope: authentication, authorisation, multi-tenant isolation, audit logging, file handling, billing webhooks. Out of scope: findings that require physical access, social engineering, or third-party services.