Security fixes are provided for the latest release only.

Do not report security vulnerabilities in a public issue. Use GitHub private vulnerability reporting.

Include the affected version, impact, minimal reproduction steps, and any suggested mitigation. Never attach real vault data, credentials, OAuth tokens, calendar data, Slack messages, or issue-tracker exports. Use minimal synthetic reproduction data.

You can expect an initial response within seven days. Disclosure timing will be coordinated after the report is validated and a fix is available.