Security fixes are evaluated for the current 1.x release line. Prereleases and superseded release lines are not supported unless a security advisory states otherwise.

Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting form and include the affected revision or package version, a minimal reproduction, impact, and any mitigation you know. Do not include credentials, access tokens, or private user data.

Maintainers aim to acknowledge a private report within seven calendar days and provide a status update at least every fourteen days until it is resolved or declined. We will coordinate a disclosure timeline with the reporter when a fix is needed.

For non-security bugs and support, use the public issue forms and include the gesture, browser, and accessibility evidence requested there.