Security fixes are provided for the latest stable major release.

Report vulnerabilities privately to the repository owner rather than opening a public issue. Include affected versions, reproduction steps, impact, and any known mitigation. Do not include production credentials or user data.

Reports will be acknowledged within seven days. A coordinated disclosure date will be agreed after validation and remediation.