Security fixes are supported for the latest released minor version. Report vulnerabilities privately through GitHub Security Advisories. Include the affected version, reproduction, and impact, but never include API keys, verifier secrets, or unredacted loop state.