ZHAC is a multi-repo project. The canonical security policy — supported versions, the private disclosure process, and response expectations — lives in the zhac-docs repo:

➡️ https://github.com/zhac-project/zhac-docs/blob/main/SECURITY.md

Please do not open a public issue for a security report. Email zhac.project@gmail.com with details and steps to reproduce. You will receive an acknowledgement; please allow time for a fix before any public disclosure (coordinated disclosure).