Security

SECURITY.md

Security Policy

Supported Versions

Security fixes are prioritized for the latest release line.

Reporting a Vulnerability

Please do not open public issues for security vulnerabilities.

Use one of the following private channels:

Repository security advisory (recommended)
Maintainer contact email defined by your organization

Please include:

Vulnerability description
Impact assessment
Reproduction steps or PoC
Affected versions and environment

License Compliance

If you identify potential commercial-use compliance risks or licensing conflicts, report them through the same private channels.

Response Process

Initial triage: within 3 business days
Confirmation and scope assessment
Patch preparation and verification
Coordinated disclosure and release note update

Disclosure

After a fix is available, we will publish a changelog/release note with impact summary and upgrade guidance.

There aren't any published security advisories