Only the latest minor release receives security fixes.

Please report security issues privately via GitHub Security Advisories.

Do not open a public issue for security-sensitive findings.

We aim to acknowledge reports within 72 hours and to ship a fix or mitigation within 14 days for High/Critical severity issues.