Picocart is in early preview (0.x). Only the latest released version receives security fixes.

Please report security vulnerabilities privately to oss@autonnel.com. Do not open a public GitHub issue for security problems.

Include as much detail as you can: affected version, reproduction steps, and impact. We will acknowledge your report within a few business days, keep you informed of progress, and credit you in the fix release unless you prefer to remain anonymous.