Security policy

These workflows build and publish npm packages, so a vulnerability here can affect every package that uses them.

Reporting a vulnerability

Please do not open a public issue. Report it privately through GitHub: Security → Report a vulnerability in this repository.

Include the affected workflow or script, the version or commit, and steps to reproduce.

Only the latest release receives fixes. Callers should keep their pinned SHA current. Dependabot does this automatically.