Security fixes are applied to the latest published version.
Use GitHub's private security advisory flow for this repository. Do not disclose a vulnerability in a public issue before a fix is available.
Never include a real OTP, phone number, authentication message, token, password, or account identifier in a report. Use invented examples that reproduce the issue.
The package processes strings locally, has zero runtime dependencies, and performs no network requests. Applications integrating it remain responsible for access control, message retention, logging, and secure disposal of extracted OTPs.