Security Policy
Supported versions and the private GitHub channel for reporting a vulnerability.
Security fixes target the latest 0.1.x release and the current main branch. Older releases, other branches, forks and recreated historical tags are not supported.
| Version | Status |
|---|---|
Latest 0.1.x release | supported |
Current main branch | supported |
| Other branch, historical tag or fork | not supported |
The current public release is v0.1.4. The deleted historical v1.0.0 tag must not be recreated.
Private reporting
Do not open a public issue for an exploitable vulnerability. Use the GitHub private advisory form. Do not contact the maintainer by personal email.
If private reporting is unavailable, open a minimal public issue asking for a private contact channel. Do not include cookies, downloaded media, private URLs, database contents or other sensitive details.
Include the affected commit or image tag, deployment method, clear reproduction steps and the expected impact. You should receive an acknowledgement within seven days and an initial assessment within fourteen days.
The reference text remains SECURITY.md.