Report vulnerabilities through GitHub private security advisories, not public issues. Include version, platform, reproduction, impact, and mitigation. Remove private source and credentials from all attachments.

The latest release line receives security fixes. Relevant issues include path escape, secret indexing, unsafe native-analyzer execution, crafted-parser denial of service, SQLite corruption or injection, and release supply-chain compromise. Maintainers aim to acknowledge complete reports within five business days.