The latest tagged release receives fixes. Older tags do not get backports.

Report through GitHub private vulnerability reporting. Do not open a public issue for a security problem.

Include the affected version, what an attacker can do, and a reproduction if you have one.

Expect an acknowledgement within seven days. Confirmed reports get a fix and an advisory; the advisory credits the reporter unless you ask otherwise.

The package has no dependencies outside the standard library, does no I/O, and reads no files or network. The realistic surface is the library's own logic: a transition accepted that the graph does not list, a guard bypassed, or state left inconsistent after a hook returns an error. Reports in that area are in scope.

Hooks are your code. A hook that panics, blocks, or mutates shared data without synchronization is not a vulnerability in this package.