Report vulnerabilities privately through GitHub's private vulnerability reporting. Never open a public issue or pull request for a security problem: that discloses it before a fix exists. Include reproduction steps and your assessment of impact.

The latest release is the only supported version: the head of the prod branch and the newest ghcr.io/antasphere/slideless tag. Self-hosted instances upgrade with ./update.sh (docs/self-hosting/upgrade.md).

The enforced security posture (headers, rate limits, the fail-closed scope allowlist for machine principals, the user-content rule) is documented in docs/security/security.md.