Security fixes are prioritized for:
- The latest code on
main - The latest published npm release, once public releases are available
Older snapshots and stale forks may not receive security updates.
Please do not open public GitHub issues for suspected security problems.
Instead, report them privately to:
harun.yardimci@gmail.com
Include as much detail as you can:
- A clear description of the issue
- Steps to reproduce
- Impact assessment
- Any suggested mitigation if you already have one
You can expect:
- An acknowledgment within 5 business days
- A follow-up once the issue has been triaged
- Coordination on disclosure timing when a fix is needed
Examples of issues that should be reported here:
- Remote code execution paths
- Authentication or authorization bypasses
- Sensitive file exposure
- Command injection
- Unsafe handling of secrets, tokens, or stored credentials
For normal bugs, feature requests, and setup questions, use the channels in SUPPORT.md.