There are no supported releases. StoryEngine is a work in progress, public but not released (README). No version receives security fixes: the v1.0.0-alpha.* tags are builds the project made for itself, not releases anyone is supported on, and a fix, if one is made, lands on main.

Report it privately, through GitHub's private vulnerability reporting: Report a vulnerability, on this repository's Security tab. Please do not open a public issue or pull request for it, and do not include a working exploit anywhere public.

Say what is affected — the commit, or the tag, you found it on — and how to reproduce it.

If the Security tab has no Report a vulnerability button, the setting behind it is not switched on yet. Open a public issue that asks only for a private way to send a report, and leave every detail of the problem out of it.

There is no commitment to a response time. This is one person's project. A report will be read, but it may not be answered quickly, and nothing here promises a fix, an advisory or a credit. That policy, and the private channel, are recorded in releases §0.1a.