Security fixes are developed on main. Report the exact affected package version or source commit. This policy does not establish a support period for individual tagged versions.

Report suspected vulnerabilities privately to github@mentordosnerds.com. Keep exploitable security details out of public issues, pull requests and comments while the report is being investigated.

Include the affected package version or commit, the potential impact, reproduction steps or a minimal proof of concept, and any proposed mitigation. Remove credentials, access tokens, personal data and unrelated private code from examples.

Maintainers assess reports and coordinate a fix and disclosure with the reporter when appropriate. For ordinary bugs and usage questions, use the channels in SUPPORT.md.