Please do not open a public issue for a suspected vulnerability involving key handling, authentication, packet-filter bypass, cryptography, or remotely triggerable resource exhaustion.

Use GitHub's private vulnerability reporting for this repository. Include the affected revision, hardware/runtime, a minimal reproducer, impact, and any suggested remediation. Reports will be acknowledged as soon as practical.

Only the latest revision on main receives security fixes during the initial development phase. No released version should be assumed audited unless its release notes explicitly say so.