Report suspected vulnerabilities through this repository's GitHub Security → Advisories → Report a vulnerability form (private vulnerability reporting). Do not put exploit details, credentials or private data in a public issue. Private reporting must be enabled before the public release.

Include the affected version or commit, configuration, impact, reproduction steps and any suggested mitigation. Maintainers will coordinate investigation, fixes and disclosure with the reporter. There is no guaranteed response time or separate long-term security maintenance commitment for older releases.

For ordinary bugs and the supported configurations, see CONTRIBUTING.md and the support scope.