The project currently supports security updates for the latest release.

Please report vulnerabilities privately.

1. Use GitHub private vulnerability reporting for this repository (Security -> Advisories -> Report a vulnerability).
2. If private reporting is unavailable, contact maintainers through a private channel.
3. Do not open a public issue for security vulnerabilities.

Please include:

• Affected package version(s)
• PHP version and runtime environment
• Reproduction steps or proof of concept
• Impact assessment (confidentiality/integrity/availability)
• Any known workaround

• Initial acknowledgment: best effort, typically within a few days
• Triage: best effort, based on maintainer availability
• Fix and release timeline depends on severity and exploitability

If a report is accepted, a patched release will be prepared and published. Credit will be provided unless you request otherwise.