Security fixes are applied to the latest published major version.

Do not open a public issue containing a secret, exploit, or private project data. Report the issue privately to the maintainers with the affected version, reproduction steps, and expected impact. Rotate any credential that may have been exposed before sharing a redacted reproduction.

The quality scanner is a deterministic policy gate, not a replacement for dependency scanning, SAST, DAST, or a professional security review.