Only the latest commit on the default branch is supported until the first stable release. There are no versioned security-support guarantees yet.

Please report vulnerabilities privately through GitHub's Report a vulnerability link in the repository's Security tab. Do not open a public issue for an undisclosed vulnerability.

Include the affected commit, deployment configuration, reproduction steps, and impact. Remove media paths, tokens, and original media from reports.

We will acknowledge valid reports, investigate them, and coordinate disclosure with the reporter. Response times may vary while the project is pre-release.