This repository reports to its own mailbox and timeline, which differ from the org-wide policy. The terms below take precedence for this repository.

If you discover a security vulnerability, please report it responsibly. Do NOT open a public issue.

Send an email to opensec@ideacrafters.com with:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: within 48 hours
• Initial assessment: within 1 week
• Fix or mitigation: best effort within 30 days

See RELEASING.md for the branch and release model. Only the latest release is actively supported with security patches.

We follow coordinated disclosure. Once a fix is available, we will publish a security advisory and credit the reporter (unless anonymity is requested).