Security fixes are provided for the latest stable major release and the current prerelease when applicable.

Do not report vulnerabilities in public issues. Use GitHub private vulnerability reporting from the repository’s Security tab. Include the affected version, impact, reproduction steps, and any suggested mitigation. Remove credentials and confidential project source from the report.

General migration failures and unsupported directives are not security vulnerabilities; use the routes in docs/SUPPORT.md.