Security fixes are applied to the latest release and the current main branch. Older releases are not maintained unless a fix is explicitly backported.

Please do not open a public issue for a suspected vulnerability. Use GitHub's Report a vulnerability option in the Security tab so the report and follow-up remain private.

Include the affected version or commit, a minimal reproduction, the expected impact, and any suggested mitigation. Remove API keys, gateway credentials, private source code, prompts, transcripts, local paths, and personal data before attaching logs or screenshots.

You should receive an initial acknowledgement within 7 days. A validated report will be assessed and fixed according to its impact and exploitability.