We take the security of our project seriously. If you believe you have found a security vulnerability, please report it to us privately. Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Instead, please report them via:
- Submit Report: Use one of the above channels to submit your report
- Response Time: Our team will acknowledge receipt of your report within 14 business days.
- Collaboration: We will collaborate with you to understand and validate the issue
- Resolution: We will work on a fix and coordinate the release process
- Please provide detailed reports with reproducible steps
- Include the version/commit hash where you discovered the vulnerability
- Allow us a 90-day security fix window before any public disclosure
- After patch is released, allow 30 days for users to update before public disclosure (for a total of 120 days max between update time and fix time)
- Share any potential mitigations or workarounds if known
Only the following versions are eligible for security updates:
| Version | Supported |
|---|---|
| Latest release on main branch | Yes |
| Development commits (pre-release) | Yes |
When using this project:
- Always use the latest stable version
- Review security advisories before updating
- Follow our security documentation and guidelines
- Keep your dependencies up to date
For a list of past security advisories, please visit our Security Advisory Page.
Last updated: December 2025