Only the latest main branch is actively supported for security fixes.
Do not open public issues for security vulnerabilities.
Please report privately to the maintainers first. Include:
- Steps to reproduce
- Impact assessment
- Affected files/endpoints
- Optional proof-of-concept
If you do not have a private channel configured yet, set one before public launch (for example, a dedicated security email or private disclosure form) and update this file.
- Initial acknowledgment: within 72 hours
- Triage decision: within 7 days
- Remediation timeline: based on severity and exploitability