Security fixes are applied to the current default branch. Archived versions are not patched.
Please do not open a public issue for security problems.
Use GitHub's private reporting channel: Security → Report a vulnerability (https://github.com/reviewer-sim/security/advisories/new), or contact the maintainer directly.
Please include:
- what the issue is and which component is affected
- steps to reproduce, or a proof-of-concept
- the impact you believe it has
A human-readable acknowledgement within a few business days, best effort. Triage and a fix timeline depend on severity; no SLA is promised. Confidentiality is maintained for reporters throughout.
This repository is source code and documentation. Reports about dependencies with a published CVE are welcome and will be tracked; issues in upstream services are out of scope.