Do not disclose suspected vulnerabilities in a public issue, discussion, or pull request. Use this repository's Security → Report a vulnerability flow to send the maintainer a private report.

Include the affected revision, impact, a minimal reproduction, and any known mitigation. Do not include live credentials or other people's private data.

Security fixes are assessed against the current main branch. There are no separately supported release branches yet.