Only the latest version on the main branch and the latest published package release receive security fixes. This project is currently pre-1.0, so APIs and package versions may change.

Please do not open a public issue for an unpatched vulnerability. If GitHub Private Vulnerability Reporting is enabled for this repository, use the Security tab to submit a private report. Otherwise email the maintainer at heikiscott@gmail.com with the subject Runfold security report.

Include the affected version or commit, reproduction steps, impact, and any suggested mitigation. Remove credentials, personal data, and unrelated logs. Please allow seven days for an acknowledgement and fourteen days for an initial assessment. We will coordinate a fix, disclosure date, and credit with the reporter where appropriate.

Do not send passwords, API tokens, or private keys in a report. If one was exposed, revoke it immediately and report only the relevant location and impact.