• The main branch is the primary support target.
• Security and correctness fixes should be prioritized on main before any release.

Please report security issues privately.

• Preferred: open a GitHub private security advisory if available on this repository.
• If advisory reporting is not available, open an issue with security in the title and use a restricted private channel for sensitive details.

Include in the report:

• impact and severity,
• affected versions and environment details,
• reproducible commands and inputs,
• and any proof-of-concept information.

• Do not publish exploitation details until a fix is acknowledged and prepared.
• Do not test beyond your authorized environment.
• Keep sensitive tokens or secrets out of logs, snippets, and issue text.