Security fixes are maintained for the latest published release. Update to the latest release before reporting a vulnerability.

Report vulnerabilities privately through GitHub private vulnerability reporting. Include the affected version, impact and a minimal reproduction. Do not put API keys, recordings, transcripts or other private data into public issues or pull requests. If a credential has been exposed, revoke it at its provider immediately; deleting a file or commit does not revoke the credential.

Repository controls and their operational requirements are documented in Repository Security.