Security fixes are applied to the latest published release. Users should upgrade to the newest available version before reporting an issue that may already have been corrected.

Please report suspected vulnerabilities through GitHub private vulnerability reporting. Do not include sensitive details in a public issue or discussion.

Include the affected version, platform, reproduction steps, impact and any suggested mitigation. You should receive an acknowledgement within seven days. Status updates will be provided while the report is investigated and before a coordinated disclosure or release.

This policy covers security defects in the library and its build or release process. Pricing-model accuracy questions without a security impact should be reported through GitHub Issues.