Only the newest release is actively supported.

Use GitHub's private Report a vulnerability option when it is available.

When private reporting is unavailable, open a minimal issue asking for a private contact channel. Do not publish exploit details, private data, or a complete proof of concept in a public issue.

This mod does not intentionally use networking, collect personal data, or run an external service. Security reports should still include the affected version, reproduction steps, and expected impact.