If you discover a security issue in CCSM, please report it privately by emailing the maintainer (see package.json author field) or by opening a draft security advisory on this repository (Security tab → Advisories → New draft). Do not open a public issue for security reports.

I aim to acknowledge reports within 7 days. There is no bug bounty — this is a personal project. Response is best-effort.

Only the latest tagged release is supported. Older releases will not receive security updates.