This is the fallback policy. Projects that carry their own SECURITY.md are more specific about what they touch, and that one applies instead.

The latest published version is the only one that gets fixes. There are no maintenance branches.

Please don't open a public issue for a security problem.

Use the repository's Security tab, Report a vulnerability, which opens a private advisory only you and I can see. If that button isn't there, email cbosch101@gmail.com with the repository name in the subject.

Expect a first response within a week.

Please include what you found, how to reproduce it, and what an attacker gets out of it. A proof of concept is worth more than a scanner's output, and a scanner's output on its own is usually not actionable.

In scope: anything that leaks a credential, reads data belonging to someone else, or lets untrusted input reach code execution.

Out of scope: findings that need an attacker to already control the machine the code runs on, and anything that depends on a dependency's published advisory without a working path to it in this code. Report the latter upstream.