Before the first stable Action release, the supported revision is the qualified full commit SHA in the README usage example. Consumers should pin that Action revision and pin the Smoque package with both an exact version and its published tarball SHA-256 digest.

Please use GitHub's private vulnerability reporting for this repository. Do not open a public issue for an unpatched vulnerability.