Security fixes are supported for version 0.2.x.

Report vulnerabilities privately using GitHub private vulnerability reporting on this repository. Use the Security tab and Report a vulnerability. If the private form is unavailable, do not disclose vulnerability details publicly; ask through a public issue for private reporting to be enabled without including exploit details or sensitive data.

Maintainers aim to acknowledge reports within five business days and provide an initial assessment within ten business days. These are response targets, not a guaranteed resolution time. Coordinate disclosure after a fix is available.

Do not post API keys, customer audio, transcripts or other customer data in public issues. Use synthetic examples and redact secrets in private reports too.