Report security issues to [email protected]. Do not open public issues for vulnerabilities.
- 48 hours — acknowledge receipt
- 7 days — initial assessment
- 24-48 hours — patch release for confirmed vulnerabilities
Only the latest release is supported with security patches.