Security fixes are made on the latest release line and the main branch. Older release lines are not maintained.

Report suspected vulnerabilities through GitHub private vulnerability reporting. Do not disclose vulnerability details in a public issue, discussion, or pull request.

Include the affected version, reproduction steps, potential impact, and any suggested mitigation when available. This is a portfolio project rather than a commercially supported service, so reports and fixes are handled on a best-effort basis without a guaranteed response time.