Only the latest non-prerelease version of an active project is supported unless its repository states otherwise. Prototype and consolidation branches receive no security-support promise.

Use GitHub vulnerability reporting on the affected repository when available. Otherwise open a minimal issue asking for a secure contact path; do not include exploit details, credentials, or sensitive data in a public issue.

Include the affected version or commit, impact, reproducible steps using synthetic data, and any known mitigation. Reports are acknowledged and triaged according to the affected repository's published support policy.