Until a stable release, security fixes target the latest 0.x version. After 1.0, the latest major version is supported unless announced otherwise.

Please report suspected vulnerabilities using GitHub's private vulnerability reporting, which is enabled for this repository. If that channel is unavailable, contact a listed maintainer privately and ask for a secure reporting channel; do not disclose exploit details in a public issue.

Include affected versions, reproduction steps, impact, and any suggested mitigation. Maintainers will acknowledge and coordinate fixes as capacity permits; there is no guaranteed response SLA.

The package does not fetch content or inject HTML. Consumers remain responsible for trusted child content, URLs, accessible media descriptions, and the security of their applications.