Only the latest minor release line receives security fixes.

Please report security vulnerabilities privately — do not open a public issue for them.

• Preferred: use GitHub's private vulnerability reporting via the repository's Security tab → "Report a vulnerability" (advisories/new), if enabled.
• Otherwise: email the maintainer at neilotoole@apache.org.

Please include reproduction steps and the affected version. You can expect an acknowledgement, and we will coordinate a fix and a disclosure timeline with you.