Security fixes are provided for the current released version of this repository. The supported version is therefore the version marked Latest on the GitHub Releases page; older releases are not maintained. This avoids a hard-coded version table becoming stale whenever a new release is published.

Report suspected vulnerabilities through GitHub's private vulnerability reporting form. Reports are visible only to the repository's security managers while they are triaged and coordinated.

• Primary maintainer: Jean Kadang (@JeanKadang)

Do not open a public GitHub issue or discussion with exploit details, credentials, private repository content, or other sensitive information. If the GitHub form is unavailable, contact the primary maintainer through an existing private channel without including secrets in the initial message.

If additional maintainers are invited to the project, this section should be updated with the current security contact list.

Please include enough detail to reproduce and assess the issue:

• A short description of the vulnerability and affected area.
• Steps to reproduce, proof of concept, or affected files where appropriate.
• The expected impact.
• Any known workaround or mitigation.

The maintainer will acknowledge valid reports as soon as practical, triage the impact, and coordinate remediation before public disclosure. If the report is not considered a security vulnerability, the maintainer will explain why and may redirect the issue to the normal GitHub issue tracker.

Security reports should focus on risks such as exposed secrets, unsafe execution paths, dependency or workflow supply-chain issues, authorization problems, or vulnerabilities in the local web viewer. General content corrections, role taxonomy changes, documentation improvements, and feature requests should be filed as normal GitHub issues.