Security fixes are applied to the latest released version and the main branch.

Please report suspected vulnerabilities privately through GitHub's private vulnerability reporting. Include reproduction steps, affected versions, and the potential impact. Do not include credentials, private data, or exploit details in a public issue.

If private vulnerability reporting is unavailable, contact the maintainer at the email address listed in CITATION.cff. You should receive an acknowledgement within 14 days. The maintainer will coordinate disclosure after the issue is understood and, where possible, fixed.