Security fixes are made against the current master branch.

Older branches, tags, and commits are not supported unless this repository documents a separate maintenance policy in the future.

Use GitHub's private vulnerability reporting for this repository.

Do not report vulnerabilities through public issues, pull requests, or discussions.

Include the affected commit or branch, the security impact, reproduction steps when possible, and any suggested mitigation.