Security fixes are applied to the latest release on main.

Please do not open a public GitHub issue for security vulnerabilities.

Report them privately to security@hrpulsar.com with:

• a description of the issue and its impact,
• steps to reproduce (proof of concept if possible),
• the affected version or commit.

We will acknowledge your report within 72 hours, keep you informed of the progress, and credit you in the release notes once a fix ships (unless you prefer to stay anonymous).

Please give us reasonable time to release a fix before any public disclosure.