Security fixes are currently applied to the latest code on the main branch. The project is pre-1.0 and does not yet promise long-term support for older revisions.

Please do not disclose suspected vulnerabilities in a public issue.

Use GitHub's private vulnerability-reporting flow for this repository. Include:

• the affected commit or version;
• the impacted files or components;
• minimal reproduction steps;
• the expected and observed behavior;
• the potential impact; and
• any suggested mitigation.

If private vulnerability reporting is unavailable, open a public issue containing only a request for a private contact channel. Do not include exploit details, secrets, or affected-user information.

You should receive an acknowledgement within seven days. Validation and remediation timelines depend on severity and reproducibility. Please allow time for a coordinated fix before public disclosure.

Only test repositories, systems, and data you own or are authorized to assess. Do not use the project to access data without permission, disrupt services, or retain secrets. Generated findings and patches require human review and do not constitute certification, production-safety proof, or authorization to test third-party systems.