中文为维护源；English mirrors the same policy for readers.

当前维护线是 1.1.x。安全修复优先进入最新 1.1.x 版本；更早版本按 best effort 处理。

The maintained line is 1.1.x. Security fixes target the latest 1.1.x release first; older releases are best effort.

请优先使用 GitHub private vulnerability reporting。若页面不可用，请先开一个不包含漏洞细节、token、日志或可复现实例的 GitHub issue，说明需要私下披露安全问题。

Use GitHub private vulnerability reporting first. If it is unavailable, open a GitHub issue without exploit details, tokens, logs, or reproduction data, and ask the maintainer to move the report to a private channel.

不要提交 .env、Notion integration token、OAuth client secret、私钥或带有敏感 workspace 内容的日志。若 token 已经公开，请立即在 Notion 侧轮换，并撤销旧 token。

Do not commit .env, Notion integration tokens, OAuth client secrets, private keys, or logs containing sensitive workspace content. If a token has been exposed, rotate it in Notion immediately and revoke the old token.

本 SDK 按 Notion internal integration 维护和 live validation。OAuth helper 是薄封装，保留给 public integration 调用方，但不属于当前 live validation 范围。

This SDK is maintained and live-validated for Notion internal integrations. OAuth helpers are thin pass-through wrappers for public integration callers, but they are outside the current live-validation scope.