Only the latest release is actively supported with security updates.

If you discover a security vulnerability, please report it privately rather than opening a public issue.

• Use GitHub's "Report a vulnerability" button under the Security tab.
• Provide clear reproduction steps and, if possible, a proof of concept.
• Do not disclose the issue publicly until it has been addressed.

You can expect an initial response within a few days. Confirmed issues will be patched in the next release; we will credit the reporter unless anonymity is requested.