Only the latest published release receives security fixes. Older tags and arbitrary commits are unsupported.

Report vulnerabilities privately with GitHub private vulnerability reporting.

Do not use public GitHub issues, pull requests, discussions, or other public forums for vulnerability reports.

Include as much of the following as you can:

• affected version, commit, or image digest
• a description of the issue and the security impact
• steps to reproduce or a minimal proof of concept
• logs, screenshots, or traces
• any suggested mitigation

There is no response-time or disclosure SLA. Published advisories, if any, appear on the repository's security advisories page.