Security fixes are released from the latest published minor line listed under GitHub Releases. Older minor lines and development builds from dev are not supported releases, even though dev is tested continuously.

Use the private vulnerability reporting form to submit the report confidentially. Please include the affected version and platform, impact, reproduction steps, and any suggested mitigation. Do not open a public issue for an undisclosed vulnerability. Published disclosures are available under GitHub Security Advisories.

You should receive an acknowledgement within seven days. A validated report will be coordinated privately until a fix and advisory are ready. This policy covers ManT-authored code and the way ManT builds or invokes bundled dependencies; upstream dependency vulnerabilities may also be reported to the corresponding upstream project.