Security fixes are provided for the latest published release.

Use GitHub's private vulnerability reporting on the ShuffleMuse security page. Do not open a public issue for an undisclosed vulnerability.

Include the affected version or image digest, deployment context, reproduction steps, impact, and any suggested mitigation. You should receive an initial response within seven days. Please allow time for investigation and a coordinated fix before public disclosure.