Security fixes are provided for the latest published 0.x release.

Please use GitHub's private vulnerability reporting feature. Do not open a public issue for suspected authentication, session, CSRF, request-routing, or credential-exposure vulnerabilities.

Include a minimal reproduction, affected versions, expected impact, and any suggested mitigation. You should receive an acknowledgement within seven days.

Never include production credentials, session cookies, access tokens, private source code, or user data in a report.