Security fixes are prioritized for the latest tagged release and the current main branch.

• Prefer GitHub private vulnerability reporting for this repository when it is available.
• If private reporting is not available, avoid posting exploit details in a public issue.
• Share the affected version or commit, impact, reproduction steps, and any sanitized logs or screenshots needed to understand the issue.

• Initial triage target: within 5 business days.
• Follow-up status: once we understand impact, scope, and remediation path.