Report security issues privately through GitHub's vulnerability reporting form. Include the affected version, reproduction steps and impact. Avoid putting unpatched vulnerabilities in public issues.

The latest released line receives maintenance by default. Older-line security fixes are evaluated per issue and documented when shipped.