Please do not open a public GitHub issue for security vulnerabilities.

Use GitHub's private vulnerability reporting: 👉 Report a vulnerability

We follow coordinated disclosure — fixes ship before public disclosure. Expected response: within 7 days.

Coordination is the fleet's inbox + sync-script substrate. There is no versioned release surface; the main branch is the only supported state.