Until a stable release exists, only the latest published prerelease and the default branch receive security fixes. Older prereleases are unsupported.

Do not open a public issue. Use GitHub's Report a vulnerability flow on the repository Security page. If that flow is unavailable, contact the repository maintainer privately through GitHub before sharing technical details.

Include the affected revision, impact, reproduction steps, and a minimal redacted proof of concept when safe. Never include credentials, private project content, paid assets, or third-party personal data.

We aim to acknowledge a report within seven days, assess severity and scope, coordinate a fix, and agree on disclosure timing. Credential exposure, dependency or build-pipeline compromise, unsafe asset mutation, and supply-chain issues are in scope. Feature requests and ordinary bugs should use the public issue templates.