For project information, see README.md. For contribution rules, see CONTRIBUTING.md. For community conduct concerns, see CODE_OF_CONDUCT.md.

Security fixes are intended for the latest supported release. Older releases may no longer receive fixes.

Do not report security vulnerabilities publicly. Do not post sensitive details in GitHub Issues, Discussions, pull requests, comments, or public chat.

Use GitHub Private Vulnerability Reporting when it is enabled for the repository. Otherwise, contact the repository maintainer privately through an authenticated GitHub account.

When reporting a vulnerability, include the affected version, relevant files or workflow, reproduction steps, and potential impact where known.

Examples include:

• malicious or unexpectedly modified repository files;
• compromised GitHub Actions or release automation;
• accidentally committed credentials or secrets;
• malicious third-party assets introduced into the project; or
• release artifacts that appear to have been tampered with.

Normal resource-pack bugs, compatibility problems, documentation issues, and feature requests are not security vulnerabilities.

Please allow reasonable time for investigation and remediation before public disclosure of sensitive technical details.