The current maintenance branch and latest prerelease receive best-effort fixes. Older versions have no support guarantee. This experimental community project has no formal security audit or manufacturer endorsement.

Use private vulnerability reporting if available. Otherwise open an issue asking for a private contact, without sensitive details. Send affected versions, impact and synthetic reproduction steps through the agreed private channel. Never send account credentials, tokens, device data or production configuration in public issues.

The maintainer and reporter will coordinate investigation, disclosure and a new release as appropriate. Reporter credit requires consent. Release assets are never silently replaced. No response-time guarantee is offered.