Report vulnerabilities privately using GitHub Security Advisories. If GitHub is unavailable, contact the maintainer at [email protected]. Do not disclose vulnerabilities in public issues.

The full policy, supported versions, requested report details, and response timelines are maintained in SECURITY.adoc.