Use GitHub's private vulnerability reporting or email michael.habib@hadrian.co with details. Please do NOT open a public GitHub issue for security-sensitive findings.

We'll acknowledge within 72 hours and aim to land a fix within 14 days for high-severity issues.

Only main and the most-recent tagged release receive security fixes.