The main branch receives security fixes. Released versions are supported for the current major line.

Please report security vulnerabilities privately by email to contact@isumanbanerjee.com. Do not open a public issue for security problems.

Include as much of the following as you can:

• A description of the vulnerability and its impact.
• Steps to reproduce or a proof of concept.
• Affected versions and configuration.

You can expect an acknowledgement within a few business days. Once the issue is confirmed and a fix is prepared, we will coordinate a disclosure timeline with you.

This policy covers the framework code in this repository. Vulnerabilities in third-party dependencies should be reported to their respective maintainers, though we appreciate a heads-up so we can bump the affected package.