See doc/SECURITY.md for the full policy — supported versions, vulnerability disclosure process, and fixed-vulnerability history.

To report a vulnerability privately, use GitHub Private Vulnerability Reporting . Do not open a public issue for security reports.