Security fixes are provided for the latest version on the main branch.

Please use GitHub private vulnerability reporting for suspected vulnerabilities. Do not open a public issue for an undisclosed vulnerability.

We aim to acknowledge reports within 3 business days and provide a status update within 10 business days. We will work with you to understand the report, develop and test a fix, and coordinate disclosure before publishing details.

We support good-faith security research conducted to avoid privacy violations, data loss, service disruption, and access beyond what is necessary to verify a finding. We will not pursue legal action for research that follows this policy.