Security fixes are provided for the latest published release.
Please use GitHub Private Vulnerability Reporting. Do not publish secrets, exploit details or sensitive workflow data in an issue. Include the affected version or commit, environment, minimal reproduction and expected impact.
The threat model and operational guidance are documented in docs/security.md.