Only the latest commit on the default branch receives security fixes. Projects created from this template own their copy. To pull fixes from upstream, run bun run upstream:sync and follow the upstream sync skill.

Do not open a public issue, pull request, or discussion for a security problem.

Report it privately with Report a vulnerability on this repository's Security tab. Include the affected area, reproduction steps, and the impact you observed.

Once a fix is available, the report is published as a GitHub security advisory, with credit if you want it.