Report vulnerabilities privately through Security → Advisories → Report a vulnerability in the affected repository. Include the revision, impact and a minimal reproduction. Do not post credentials or an exploit in a public issue.

The current main branch is the development baseline. There is no guaranteed response time or supported historical release series yet. Fixes and any advisory are coordinated with the reporter.

Ordinary bugs and feature requests belong in Issues.