Security fixes are made on the latest commit of the main branch and the latest extension release. Older versions are not maintained.

Use GitHub's private reporting form for this repository. Do not disclose exploitable details in a public issue, discussion, pull request, or package submission.

Include a clear description, reproduction steps or proof of concept, affected component or release, impact, and any suggested mitigation. Do not access other users' data or disrupt the production service while investigating.

We will acknowledge valid reports within seven days, assess and reproduce them, and coordinate a fix and disclosure timeline with the reporter. We may ask for additional details or credit the reporter unless they request otherwise.