Only the latest released version receives security fixes.

Do not open a public issue. Use GitHub's Report a vulnerability form in the Security tab of this repository. Include reproduction steps, affected versions, impact, and a minimal proof of concept when possible.

Please allow up to 7 days for an initial response. We will coordinate disclosure after a fix is available.

Never attach real vault data, credentials, OAuth tokens, calendar data, Slack messages, or issue-tracker exports. Use minimal synthetic reproduction data.