Until the project reaches 1.0, security fixes are released for the latest published minor version only.

Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue.

Include:

• The affected version.
• A minimal reproduction or proof of concept.
• The impact you believe is possible.
• Any suggested remediation, if known.

You should receive an acknowledgement within seven days. Confirmed issues will be coordinated privately until a fix and disclosure plan are ready.

Never include credentials, private transcripts, or other sensitive data in a report.