Report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue.

Include the exact affected version, minimal reproduction, impact, topology, and sanitized evidence. Never include customer data, tokens, passwords, database dumps, certificate private keys, CA keys, signing keys, backup credentials, or raw telemetry.

There is no fixed response SLA. Operators should deploy immutable, verified releases and qualify security updates promptly.

See the full security reporting guide and deployment hardening.