Security fixes are applied to the latest version on each repository's default branch. Older releases may not receive patches unless their repository says otherwise.

Please do not disclose suspected vulnerabilities in a public issue, discussion, or pull request.

Use the affected repository's Security tab to submit a private vulnerability report. Include:

• the affected repository, component, and version or commit;
• clear reproduction steps or a minimal proof of concept;
• the expected and observed behavior;
• the potential impact and any suggested mitigation.

You can expect an initial response within five business days. Please allow reasonable time to investigate and release a fix before publishing details.

Reports made in good faith are appreciated. Avoid accessing data that is not yours, disrupting services, or testing against third-party systems without permission.