We take the security of this project seriously and strive to provide security updates for actively maintained versions.

Generally, only the latest stable release receives security updates. Older versions may not receive security patches unless explicitly stated otherwise.

We recommend keeping your installation up to date to benefit from the latest security fixes and improvements.

If you discover a security vulnerability in this project, we appreciate your efforts to responsibly disclose it.

Please do not report security vulnerabilities through public GitHub issues or discussions.

Instead, please report vulnerabilities privately using one of the following methods:

• GitHub Security Advisories: Navigate to the repository's Security tab and select Report a vulnerability, if available.
• Private Contact: Contact the project maintainers through the designated security contact channel.

When reporting a vulnerability, please include:

• A clear description of the vulnerability.
• Steps to reproduce the issue.
• The affected versions or components.
• The potential security impact.
• Any relevant proof-of-concept code or supporting information.

We aim to handle security reports in a timely and responsible manner.

1. Acknowledgment: We aim to acknowledge vulnerability reports within 5 business days.
2. Investigation: We will investigate the reported issue and assess its severity and impact.
3. Updates: We aim to provide progress updates approximately every 14 days while the issue remains under investigation.
4. Resolution: If the vulnerability is confirmed, we will work toward a fix and release a security update when appropriate.
5. Disclosure: We may publish a security advisory after the vulnerability has been addressed.

If a reported issue is determined not to be a security vulnerability, we will provide an explanation where possible.

Response and resolution times may vary depending on the complexity and severity of the issue.

We kindly ask security researchers to:

• Avoid publicly disclosing vulnerabilities before a fix is available.
• Avoid accessing, modifying, or deleting data that does not belong to them.
• Refrain from disrupting services or affecting other users.
• Allow maintainers reasonable time to investigate and resolve reported issues.

We appreciate responsible security research and coordinated disclosure.

To help keep your environment secure, we recommend:

• Using the latest stable version of the project.
• Keeping dependencies and related software up to date.
• Following the project's recommended configuration and deployment practices.
• Never exposing credentials, API keys, or other sensitive information.
• Regularly reviewing security advisories and updates.

We sincerely appreciate the security community and everyone who helps make this project safer.

Your responsible reporting and contributions help protect all users of this project.