Do not report vulnerabilities in public issues. Send a minimal reproduction, affected version, impact, and any mitigation to security@rushdb.com.

We will acknowledge the report, assess affected release lines, coordinate a fix, and publish an advisory when users need to act. The current 3.x release line receives security fixes; the final 2.x maintenance tag receives fixes only when explicitly announced.