Security fixes are applied to the current main branch and the latest published npm package.
If you believe you found a security issue:
- do not open a public issue first
- use GitHub private vulnerability reporting if available
- include:
- affected package or path
- reproduction steps
- impact summary
- dependency versions when relevant
We will triage the report, confirm impact, and prepare a fix before public disclosure when possible.