The latest state of main and the latest published minor release receive security fixes.

Do not open public issues for security vulnerabilities.

1. Use GitHub private vulnerability reporting.
2. If private reporting is unavailable, contact the maintainer and request a private channel.
3. Include the impact, affected runner image or label, action version and configuration, and reproducible steps. Do not include credentials or other secrets.

• Initial acknowledgement: within 3 business days.
• Triage and severity assessment: within 7 business days.
• Mitigation timeline: depends on severity.