The main branch is supported, and tagged releases get fixes for the current minor version.

Don't open a public issue.

Report privately through GitHub's private vulnerability reporting on this repository, which opens a draft advisory only the maintainers can see. Or email code@kingletas.com.

Tell us what it does wrong, how to reach it, and what an attacker gets. A failing test is the clearest report there is.

You'll get an acknowledgement, a triage verdict, and for anything confirmed, a fix with a regression test and a sweep for the rest of that defect's class.