Security fixes are provided for the current default branch and the latest published release of each runtime. Older releases and development branches are not supported independently.

Do not open a public issue for a suspected vulnerability. Report it through the Arm Product Security Center or email psirt@arm.com. Identify the affected optimized runtime and include:

• the affected commit or release;
• the affected component and supported environment;
• the observed impact; and
• the smallest practical reproduction or supporting evidence.

Arm PSIRT coordinates assessment and disclosure. General bugs that do not have a security impact may be reported through the repository's public issue tracker.