Security fixes target the latest version published on PyPI. Known limits are recorded in docs/compatibility.rst.

Report vulnerabilities privately through GitHub security reporting. Include a minimal reproducer, the affected version, and Python/JDK versions. Please keep exploit details out of public issues while a fix is being prepared.