Security fixes are provided for the latest published release. During the 0.x phase, update to the latest 0.x release. The 1.x support policy will accompany the first stable release.

Report vulnerabilities privately through the repository's security advisory form. Please keep reproduction details in that private report while a fix is being coordinated.

Include the affected version, impact, reproduction, and any suggested mitigation. Expect an acknowledgement within three business days and an initial assessment within seven. Release timing depends on severity and the need to coordinate downstream updates. Credit is offered unless the reporter prefers to remain anonymous.