Before v1.0.0, security fixes are applied to the latest revision of main. After the first stable release, supported release lines and end-of-support dates will be documented here.

Use GitHub private vulnerability reporting for this repository. Include a minimal reproducer, expected and observed behavior, affected versions, impact, and any suggested mitigation. Do not include secrets or production data.

Maintainers will acknowledge the report, reproduce and assess it privately, coordinate a fix and advisory, and credit the reporter when requested. Public disclosure should wait until a fix or agreed mitigation is available.

Documents, query strings, media types, extension/profile callbacks, and pagination cursors are untrusted protocol inputs. Resource limits and callback isolation are part of the maintained security boundary.

Applications remain responsible for transport limits, authentication, authorization, rate limiting, deadlines, secret handling, deployment policy, and business-level validation. Package safeguards do not replace those controls.

See docs/security.md and docs/hardening.md for adoption guidance and maintained evidence.