Security fixes apply to the current main branch. Generated projects are independent repositories and retain their own security policies after generation.

Use GitHub private vulnerability reporting for vulnerabilities in the generator, generated defaults, or repository automation. Include the affected revision, impact, and a minimal reproduction when possible.

Do not disclose a suspected vulnerability in a public issue before it has been reviewed.