Security fixes are made against the latest source on the main branch.

The historical release assets are validation artifacts, not current official application distributions.

Do not disclose a suspected security vulnerability in a public GitHub issue, discussion, or pull request.

After GitHub private vulnerability reporting is enabled for this repository, use Security > Advisories > Report a vulnerability to send the report privately. Include the affected version or commit, reproduction steps, impact, and any suggested mitigation. If private reporting is not available, do not put vulnerability details in a public issue.

Ordinary bugs without security impact belong in the normal GitHub issue tracker.