Report suspected vulnerabilities through GitHub private vulnerability reporting, rather than a public issue. Include the affected release, reproduction steps, and impact; do not include production credentials or private documents.

Security fixes target the latest release. Older releases do not have a separate maintenance branch. Repository checks and their documented exceptions are described in the development guide.