Report suspected vulnerabilities privately through the GitHub repository's Security tab. Do not open a public issue before maintainers have completed triage and coordinated disclosure.

Security fixes are released from the affected package with a Changeset. The compatible preset records the recommended and minimum secure versions, and adopter repositories receive expedited dependency-update pull requests. Products must still run their own conformance checks and deploy the patched release.