Only the latest released version of each package receives security fixes:

Please do not open a public issue for security problems. Instead, use GitHub's private vulnerability reporting:

Report a vulnerability

You can expect an acknowledgement within a few days. Please include a minimal reproduction (input, expected vs. actual behaviour) where possible.

• The libraries generate QR payload strings; they perform no network I/O and hold no secrets. The main security-relevant surface is input validation and the byte-level encoding contract (spec/SPEC.md).
• The HTTP service (service/) additionally exposes authentication (AUTH_TOKEN bearer) and rate limiting; misconfiguration reports are welcome, but deployments themselves are the operator's responsibility.