Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue before a fix and disclosure plan are available.

Include the affected version or commit, the smallest reproducer available, the expected impact, and whether untrusted encoded bytes are required.

Until the first tagged release, only the current default branch is supported. After release, the latest minor release receives security fixes. Data written by released version 1 writers remains readable according to FORMAT.md, but callers should upgrade the library to receive decoder and dependency fixes.

Use explicit ReadOptions for persisted or network-provided data. Keep MaxLength, MaxBytes, MaxDecodedBytes, and MaxDepth within the owning service's memory and latency budgets. The zero value applies conservative defaults, but application-specific limits are preferred.