Security fixes are applied to the latest released major version on the default branch (develop / published releases). Older majors may not receive patches.

Please do not open a public GitHub issue for unfixed security vulnerabilities.

Use GitHub’s private vulnerability reporting for this repository:

1. Open the repository Security tab
2. Choose Report a vulnerability
3. Include steps to reproduce, impact, and affected versions when possible

We will acknowledge the report, triage it privately, and coordinate disclosure through a security advisory when appropriate.