Security fixes are applied to the latest version on the main branch and the latest published release.

Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository when it is enabled. If private reporting is unavailable, contact the repository maintainers privately through the GitHub organization before disclosing the issue publicly.

Include the affected version, reproduction steps, impact, and any safe mitigation. Do not include credentials, personal data, production exports, or live service details in the report.