Security fixes are applied to the latest revision of the master branch. Older revisions and development branches are not supported separately.

Please do not disclose suspected vulnerabilities in a public issue.

Use GitHub's private vulnerability reporting to send a confidential report. Include, when possible:

• the affected component and revision;
• steps or a minimal example that reproduces the issue;
• the expected and observed impact;
• any suggested mitigation.

You should receive an acknowledgement within seven days. Maintainers will use the private advisory to discuss validation, remediation, and coordinated disclosure. Please allow a reasonable remediation period before publishing details.

Reports about unsafe parsing or execution, dependency vulnerabilities, malicious simulation inputs, unintended file access, and compromised build or release automation are in scope. General numerical inaccuracies without a security impact should be reported as regular bug reports.