Security fixes are applied to the latest released minor version. Older releases may receive a fix when the issue is severe and backporting is practical.

Use GitHub's private security advisory flow for this repository. Do not open a public issue for a suspected vulnerability or include real credentials, private source, or exploit details in logs and screenshots.

Include the affected version, operating system, reproduction, impact, and any suggested mitigation. Maintainers will acknowledge a complete report within five business days and coordinate disclosure after a fix is available.

Relevant reports include repository escape, unintended source disclosure, credential indexing, unsafe installer behavior, command execution, cache isolation failures, and dependency or release compromise.