Graft is pre-1.0 and ships continuously from main. Security fixes are made against the latest published npm release (@nanonets/graft); older versions are not separately patched.

Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via GitHub Security Advisories, or email shrish@nanonets.com.

We'll acknowledge your report within 3 business days and aim to ship a fix or mitigation within 30 days, depending on severity.