Report vulnerabilities privately through GitHub's private vulnerability reporting. Do not open a public issue for anything exploitable.

Please include the volto version (or commit), a minimal reproduction, and the impact you believe it has. Reports are acknowledged and fixed on a best-effort basis.

Only the latest release receives fixes.