Security fixes are handled on the latest main branch and the latest published release.

Please do not open a public issue for exploitable vulnerabilities.

Use GitHub's private vulnerability reporting or security advisory flow when available. If that is not available, contact the maintainers privately and include:

• A description of the issue.
• Steps to reproduce.
• Impact and affected versions, if known.
• Any suggested mitigation.

We will review reports as quickly as possible and coordinate disclosure when a fix is available.