安全修复面向最新稳定版本和 main 分支。旧版本不会单独维护安全补丁；升级前请先阅读对应 Release Notes 和升级恢复文档。
Security fixes target the latest stable release and the main branch. Older versions do not receive separate security patches. Review the release notes and upgrade documentation before updating.
| Version | Status |
|---|---|
| Latest stable release | Supported |
main |
Development support |
| Older releases | Unsupported |
请勿通过公开 Issue、Discussion 或 Pull Request 披露安全漏洞。使用 GitHub 的私密漏洞报告入口提交报告。
Do not disclose vulnerabilities in a public Issue, Discussion, or Pull Request. Submit the report through GitHub's private vulnerability reporting form.
报告应包含：
- 受影响版本或提交；
- 漏洞描述、攻击前提和影响范围；
- 最小复现步骤或验证代码；
- 已知缓解措施；
- 希望使用的署名信息。
不要上传真实密钥、Token、备份数据、数据库或包含客户信息的日志。必要时请先脱敏，并使用最小化测试数据。
Do not upload real credentials, tokens, backup data, databases, or logs containing customer information. Redact sensitive values and use minimal test data.
- 维护者会尽快确认报告并进行初步分级；
- 修复期间请保持细节私密，避免影响仍未升级的部署；
- 修复发布后会在安全公告或 Release Notes 中说明受影响范围、缓解措施和升级版本；
- 披露时间由报告者与维护者协调确定。
The maintainer will acknowledge and triage the report as soon as practical. Details should remain private until a fix and coordinated disclosure are ready.