Unless a repository states otherwise, security fixes are made on the latest version of the default branch. Older tags and branches may not receive patches.

Do not open a public issue for a suspected vulnerability.

Use GitHub's private vulnerability reporting feature when it is available for the affected repository. If it is unavailable, use the contact options at https://www.raymondware.com/ and include:

• The affected repository and version or commit
• A description of the vulnerability and its impact
• Reproduction steps or a minimal proof of concept
• Any known mitigations
• Whether the issue has been disclosed elsewhere

Please avoid accessing data that is not yours, disrupting services, or publishing details before a fix can be evaluated.

Receipt will be acknowledged when possible. The report will be assessed, reproduced, and prioritized based on impact and exploitability. Timing depends on severity and maintainer availability; no fixed response or remediation deadline is guaranteed.