Security fixes are applied to the current 0.1.x release line while it is supported. Pre-release snapshots and old source checkouts are not supported.

Do not open a public issue containing exploit details. Use the repository host's private vulnerability-reporting feature when available, or contact the package owner privately through the npm registry account.

Include the affected version, runtime, minimal reproduction, expected impact, and whether the issue is already public. A maintainer should acknowledge the report before any coordinated disclosure date is chosen.