Security fixes target the latest release on the main branch.

Do not open a public issue for vulnerabilities, exposed credentials, unsafe installer behavior, or private-data disclosure. Use GitHub's Report a vulnerability form under the repository Security tab.

Include affected files or versions, impact, reproduction steps, and the smallest known mitigation. Never include live tokens, private prompts, session databases, or personal data in a report.

Maintainers will acknowledge a valid report, coordinate a fix, and publish an advisory when affected users need to take action.