Security fixes are applied to the latest release and the default branch.

Please use GitHub private vulnerability reporting. Do not open a public issue for a vulnerability that could expose credentials or authenticated request data.

Include a concise description, affected version, reproduction steps using synthetic credentials, and the expected impact. Never include real cookies, tokens, request bodies, or unredacted responses.

If private vulnerability reporting is unavailable, open a public issue that contains no sensitive details and asks the maintainer to establish a private contact channel.

High-priority reports include credential disclosure, endpoint-lock bypass, unsafe redirect handling, shell execution, raw-response leakage, stale minimized-result reuse, and validation bypasses.