Security fixes are provided for the latest published 1.x line.

Please do not report security vulnerabilities in public issues.

Instead:

1. Open a private security advisory in GitHub for this repository, if available.
2. If advisories are not available, contact the maintainer privately.

Please include:

• A clear description of the issue
• Impact and affected components
• Reproduction steps or proof of concept
• Suggested mitigation (if known)

You can expect an initial response within 7 days.

1. We validate and reproduce the report.
2. We assess impact and affected versions.
3. We prepare and release a fix.
4. We publish a security advisory when appropriate.