Benemap is a continuously deployed web app, not a versioned library — there's no changelog of maintained release lines. Only the code currently on main (which is what's running live at benemap.org) is supported with security fixes. Older commits or forks are not maintained.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, email contact@benemap.org with a description of the issue and steps to reproduce it. This is a small, non-commercial side project maintained by one person, so please bear with realistic expectations:

• You should get an initial response within a few days.
• If the report is confirmed, I'll work on a fix and deploy it to benemap.org as soon as reasonably possible; there's no fixed SLA.
• If it's declined (e.g. not reproducible, out of scope, or a known/accepted limitation), I'll explain why.
• Credit is welcome in the fix's commit/changelog if you'd like it — just say so.