Security fixes are developed against the development branch and included in the next appropriate release. If a report affects an older release, maintainers may ask the reporter to confirm it against the latest release.

Please use GitHub private vulnerability reporting. Do not open a public issue for a vulnerability that has not been disclosed or fixed.

Include the affected version, relevant configuration, reproduction steps, expected impact and any suggested mitigation. Remove API keys, passwords, tokens, media names and other private data from logs or screenshots.

The maintainers will review the report privately and coordinate disclosure after a fix or mitigation is available. This project does not promise a fixed response deadline.