During the pre-1.0 period, only the latest published prerelease receives security fixes.

Do not open a public issue for a suspected vulnerability. Report it privately through GitHub Security Advisories.

Include reproduction steps, affected versions, potential impact, and any known mitigations. Remove API keys, credentials, and sensitive prompt or provider content from the report.