Unless the project states a different support policy, security fixes target the latest production release, or the latest published prerelease when no production release exists. Reports affecting prereleases and older versions are welcome, but fixes are not backported to older release lines. No response or remediation time is promised.

Do not disclose a suspected vulnerability through a public Issue, Discussion or pull request.

Use the affected repository’s Security → Advisories → Report a vulnerability option when it is available. Include the affected version, operating system, affected component or integration, reproduction steps, expected impact and any suggested mitigation. Share only the minimum evidence necessary to investigate the problem.

If private vulnerability reporting is unavailable, email lanteancode@gmail.com. Do not send source code, credentials, private keys, access tokens, unnecessary paths or other secrets by email. Begin with a concise description so a safer exchange can be arranged if more evidence is required.

Confirmed vulnerabilities are coordinated privately. A GitHub Security Advisory will be published when an issue materially affects released users.