Security fixes target main and the latest tagged release, when one exists. Older tags are not maintained. Include the exact tag or commit in a report.

Report privately through GitHub private vulnerability reporting. Do not publish a suspected vulnerability in an issue or pull request.

Include reproduction steps, expected and observed behavior, the affected platform and version, and the possible impact. Remove credentials and other sensitive data from examples.

CoreTrace Python Analyzer parses and analyzes source trees and dependency metadata. Reports about crafted input, unsafe file access or report generation should include a sanitized sample and the command used.