Security fixes target main and the latest tagged release, when one exists. Older tags are not maintained. Include the exact tag or commit in a report.

Report privately through GitHub private vulnerability reporting. Do not publish a suspected vulnerability in an issue or pull request.

Include reproduction steps, expected and observed behavior, the affected platform and version, and the possible impact. Remove credentials and other sensitive data from examples.

This policy covers vulnerabilities in the template's CMake, scripts and CI scaffolding. A generated tool should publish its own security policy for its behavior and releases.