Only the latest release receives security updates.

Do not open a public issue for security vulnerabilities.

Use GitHub's Private Vulnerability Reporting:

1. Go to the Security tab of this repository
2. Click "Report a vulnerability"
3. Fill in the details

• Acknowledge: Within 72 hours
• Assessment: Within 1 week
• Patch (critical): Within 30 days
• Patch (non-critical): Next scheduled release

• Security advisory published on GitHub
• Reporter credited (unless they prefer anonymity)
• Fix noted in CHANGELOG.md

This policy covers the @openeudi/core npm package. For issues in dependencies, please report to the respective maintainers.