Please do not report a suspected security vulnerability in a public issue, pull request, or discussion. Submit it privately through GitHub's vulnerability reporting form on this repository's Security tab. If the form becomes unavailable, open a public issue that only asks for a private reporting channel. Do not include vulnerability details, affected versions, names, credentials, or reproduction steps there.

When reporting, include the affected version or commit, the relevant route or component, steps to reproduce, and the impact you observed. Do not include real credentials, personal data, or information from private repositories. A minimal, non-sensitive proof of concept is helpful when safe to share.

The maintainer will review reports as time allows and may ask for more information. Please allow time for investigation and a fix before sharing details publicly. We will coordinate any public disclosure with the reporter; this policy does not promise a particular response or release timeline.

Security fixes are handled on a best-effort basis for the main and dev branches. There is no formal support window or guaranteed response time. Check the repository's releases and advisories for updates.