The active main branch is supported on a best-effort basis. Backports to historical revisions are not guaranteed.

• Do not publish vulnerability details in public issues.
• Use GitHub private security advisories for responsible disclosure.
• Include:
  • short vulnerability description;
  • reproducible steps;
  • potential impact assessment;
  • suggested mitigation (if available).

Reports are reviewed on a best-effort basis with no formal SLA.