Only the latest commit on master receives security fixes.

Report vulnerabilities privately through GitHub private vulnerability reporting. Do not open a public issue.

Include:

• affected version or commit
• steps to reproduce or a proof of concept
• impact as you understand it

• Acknowledgement within 7 days.
• An assessment and, if confirmed, a fix plan within 30 days.
• Credit in the advisory unless you ask otherwise.

This is a personal project maintained on a best-effort basis.