No production version has been released. Security reports affecting the main branch are accepted and investigated.

Use GitHub's private vulnerability reporting form. Do not disclose the report in a public issue, discussion, or pull request.

Include the affected revision, impact, reproduction steps, and any suggested remediation. Expect an acknowledgement within three business days and an initial assessment within seven business days. We target remediation and coordinated disclosure within 90 days, but may request a shorter or longer embargo when impact and deployment constraints justify it.

A verification bypass, signature-validation failure, identity-constraint bypass, or release supply-chain compromise is considered critical and receives immediate triage.