Security fixes target the latest version on the default branch. Older commits and unreleased local artifacts are not supported.

Please do not open a public issue for a suspected vulnerability. Use the repository's Security tab and GitHub's private vulnerability reporting form. Include the affected version or commit, impact, reproduction steps, and any proposed mitigation.

If private vulnerability reporting is unavailable, open a minimal public issue requesting a private contact channel without including exploit details, credentials, private data, or other sensitive material.

I will acknowledge a complete report when I can reproduce or triage it. Public disclosure should wait until a fix or mitigation is available.