Security fixes are prioritized for the latest release and the main branch. Older releases are supported on a best-effort basis; users should upgrade to the latest release when a security fix is available.

Please report suspected vulnerabilities privately through GitHub's security advisory form:

https://github.com/SoichiroYamane/gsplot/security/advisories/new

Do not open a public issue, include exploit details in a pull request, or post credentials, private data, or unreleased vulnerability information in a public channel. If private reporting is unavailable, contact the maintainers through a private GitHub channel and disclose only the minimum information needed to establish a safe communication path.

Please include the affected version or commit, a concise impact description, reproduction steps that do not contain secrets, and any suggested mitigation. The maintainers will acknowledge the report when practical, investigate it, coordinate a fix and disclosure timeline with the reporter, and document the public remediation using the relevant advisory, issue, or release notes.

This policy covers the gsplot package, its published artifacts, repository workflows, documentation build, and dependency or supply-chain issues that could affect users or contributors. Avoid testing against infrastructure that you do not own or have permission to assess.