Security Policy

Supported versions

Unless a repository states otherwise, the actively maintained default branch and the latest published release are the supported surfaces.

Older tags and stale branches should be treated as unsupported unless the repository explicitly says otherwise.

Do not open a public issue for security reports.

a clear description of the vulnerability and its potential impact
reproduction steps or a minimal proof of concept
the affected version, commit, or tag and the environment in which it was observed

We acknowledge reports within 5 business days and coordinate a fix and disclosure timeline with you.