The supported public version is the latest stable release. Runtime and dependency maintenance is tracked through repository releases.

Use the repository's Security → Report a vulnerability feature when private reporting is enabled. Maintainer setup instructions explain how to enable it. If that feature is unavailable, open an issue asking for a private reporting channel without posting exploit details or private data.

Never post conversation archives, credentials, private server URLs, environment files or personal filesystem paths. Use a synthetic reproduction and state the affected application, version, platform and attack prerequisites.

Server installation and network access remain under the server operator's control. Follow the upstream server's own security guidance as well as the patch documentation. The integration patch is bound to the documented baseline; do not force it onto changed files.