Security fixes are made on the current development branch and released as a new version. Once v0.1.0 is published, only the latest v0.1.x release is supported; users must update to the newest patch release to receive fixes. Unreleased snapshots and older patch releases are not maintained separately.

Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting form:

1. Open the repository's Security page.
2. Open Advisories.
3. Select Report a vulnerability.

If the private form is unavailable, open a public issue asking only for a private security contact. Do not describe the vulnerability in that issue.

Include the affected credring version, operating system and architecture, selected backend, impact, and a minimal reproduction using synthetic values. Sanitize logs and errors before attaching them.

Never include real secret values, credentials, tokens, passwords, private keys, credential identifiers, filesystem paths containing private identity information, or other sensitive user or environment data. If a real secret is disclosed accidentally, rotate or revoke it immediately; editing the report is not a substitute for rotation.

The maintainers will coordinate triage, remediation, and disclosure through the private advisory.