Security fixes are made against the latest released version. Older releases may not receive backports.

Please do not disclose a suspected vulnerability in a public issue, discussion, or pull request.

Use GitHub's private vulnerability-reporting form:

https://github.com/smarzban/tsk/security/advisories/new

Include the affected version, impact, reproduction steps, and any suggested mitigation. Reports will be acknowledged through the private advisory and coordinated there until a fix or other resolution is ready.