Security fixes target the current main branch and the latest release. Older releases are not routinely patched.

Do not file a public issue for an undisclosed security problem. Use this repository's private vulnerability reporting form instead.

Include the affected version or commit, reproduction steps, realistic impact, and any suggested mitigation. Reports about code execution, path traversal, credential exposure, or release and package integrity are especially useful.