Only the latest release and current default branch receive security updates.

Please report security vulnerabilities privately to the maintainers rather than opening a public issue. Reports are investigated promptly under responsible disclosure guidelines.

Trivy scans dependencies and repository files in CI, uploading SARIF results to GitHub code scanning.