We support the latest minor release with security fixes.
| Version | Supported |
|---|---|
| latest | yes |
| older | no |
Please do not open a public GitHub issue for security problems.
Instead, report privately via one of:
- GitHub Security Advisories — preferred. Go to the Security tab → Report a vulnerability.
- Email — security@your-domain.example. Encrypt with our PGP key if available.
Please include:
- A description of the issue and its impact.
- Steps to reproduce (proof of concept welcome).
- Affected versions / commit SHAs.
- Any suggested fix (optional).
- Acknowledge receipt within 3 business days.
- Triage and provide an initial assessment within 7 business days.
- Coordinate a disclosure timeline with you. We aim to release a fix within 90 days for high-severity issues.
- Credit you in the release notes and advisory, unless you prefer to remain anonymous.
- Vulnerabilities in third-party dependencies — please report upstream.
- Findings from automated scanners without a working proof of concept.
- Issues requiring physical access to a user's device.
- Social engineering of project maintainers.
We thank the following researchers for responsibly disclosing issues:
No entries yet.