Security fixes are released on the latest v0.1.x version. Older patch releases, pre-release revisions, and untagged snapshots are not maintained separately.

Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting form:

1. Open the repository's Security page.
2. Open Advisories.
3. Select Report a vulnerability.

If private reporting is unavailable, open a public issue asking only for a private security contact. Do not include vulnerability details in that issue.

Include the affected module version, Go version, operating system, architecture, impact, and a minimal reproduction using synthetic data.

Never include encryption keys, plaintext, credentials, tokens, passwords, private keys, real ciphertext, private filesystem paths, or other sensitive environment data. If a real secret is disclosed accidentally, rotate or revoke it immediately; editing a report or Git history is not a substitute for rotation.

The maintainers will coordinate triage, remediation, and disclosure through the private advisory.