Do not disclose a suspected vulnerability in a public issue or discussion. Report it privately through GitHub's private vulnerability reporting for this repository. If that facility is unavailable, contact the repository owner privately and include affected versions, reproduction details, and impact.

Only release lines named in a release manifest receive security fixes. Until the first tagged release, the default branch is the only maintained line.