Trail-code (formerly graft) is pre-1.0 and ships continuously from main. Security fixes are made against the latest published npm release (@trailhq/trail, also published as @nanonets/graft); older versions are not separately patched.

Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via GitHub Security Advisories, or email shrish@nanonets.com.

We'll acknowledge your report within 3 business days and aim to ship a fix or mitigation within 30 days, depending on severity.