Security fixes target the current main branch and the latest published release of favseed. Older releases do not receive separate backports. When possible, check whether a finding still occurs on main or the latest release.

For sensitive findings, use GitHub private vulnerability reporting. If GitHub does not show a Report a vulnerability button, open an issue asking for a private reporting channel without including vulnerability details.

Include the affected version, a minimal reproduction, the expected impact and the environment. Reports about SVG processing, the raster engine, CLI or integrations, the browser tool, dependencies and release automation are welcome. Use the bug-report form for ordinary output or integration problems.

Keep vulnerability details private while the maintainer investigates and prepares a fix. The maintainer will coordinate disclosure with the reporter and publish an advisory with affected versions and remediation when the fix is available.