# Security policy

## Supported version

Security fixes are made on the current `main` branch of this public mirror.

## Reporting a vulnerability

Do not include exploit steps, credentials, private URLs or personal data in a public issue. Use GitHub's private vulnerability-reporting feature for this repository when it is available. If it is unavailable, open a public issue only to request a private contact channel; do not include technical details.

Include the affected path, observed impact, a minimal reproduction without sensitive data and any proposed mitigation. Reports are acknowledged after the scope can be reviewed.