The latest published release is supported. For an unreleased project, report issues against the default branch.

Use the affected repository's Security → Report a vulnerability feature. Never disclose a vulnerability in a public issue. If the button is unavailable, use GitHub's private reporting guidance rather than publishing exploit details.

We aim to acknowledge within 3 days, assess within 7 days, and provide a fix or mitigation for high or critical findings within 30 days. These are maintenance targets for a solo project, not a contractual service guarantee.

Reports cover the code in these repositories, not third-party services.