Only the latest released version receives security updates.

Report vulnerabilities privately through a GitHub security advisory. Do not open a public Issue.

Please include:

• The affected version and platform.
• The impact and attack scenario.
• A minimal reproduction or proof of concept.
• Affected files, commands, or protocol surfaces.
• Any known mitigations or workarounds.
• Whether the issue has been disclosed previously, and to whom.

Remove API keys, tokens, private source code, personal data, and sensitive logs from the report.

The project does not promise a fixed response SLA. Reporters and maintainers are asked to coordinate validation, remediation, and disclosure so users have time to update before technical details are published.