Please do not disclose suspected vulnerabilities in a public issue, discussion, pull request, commit, or log.

For a public repository, use GitHub's Report a vulnerability action when it is available. Otherwise, contact the organization owner privately at maxfominov@gmail.com. Include the affected repository and version, impact, reproduction steps, and any suggested remediation. Do not send credentials, tokens, private keys, or unrelated sensitive data.

We will acknowledge the report, establish a private coordination channel, assess the impact, and agree on disclosure timing. No response-time or remediation SLA is promised unless a repository publishes one explicitly.

A shared support matrix has not yet been established. Until a repository publishes its own policy, the default branch is the only version routinely evaluated for fixes.