Security fixes are applied to main; there is no long-term support branch yet.

Please do not report security vulnerabilities through public GitHub issues.

Open a private advisory via GitHub Security Advisories, or email admin@writerslogic.com.

Please include a description of the vulnerability and its impact, steps to reproduce (without real secrets or credentials), and the affected version/commit. You can expect an initial response within a few days; coordinated disclosure is appreciated — please give a reasonable window to ship a fix before publishing details.

• All GitHub Actions are pinned to full commit SHAs.
• OpenSSF Scorecard, Dependency Review, and Dependabot run in CI.
• Releases are published with build provenance where the package registry supports it (see the badges and the release workflow).