Security fixes are released for the current stable version published under the npm latest dist-tag. Testing and older versions should be upgraded before a report is investigated.

Send vulnerability reports privately to claworld@xfx.studio.

Include the affected version, reproduction steps, expected impact, and any relevant logs with credentials and personal data removed. Do not open a public issue for an undisclosed vulnerability.

XFX Studio will acknowledge a complete report within five business days and coordinate remediation and disclosure with the reporter.