Security fixes are applied to the latest version on the default branch.

Please do not open a public issue for a vulnerability or include real Google Drive links, item IDs, file names, or account information in a report.

Use GitHub private vulnerability reporting to describe the issue, affected version, reproduction steps, and potential impact. If private reporting is unavailable, open a public issue containing no sensitive details and ask the maintainer for a private contact channel.

You should receive an acknowledgement within seven days. The maintainer will coordinate validation, remediation, and disclosure timing with the reporter.