Security updates are provided for the current main branch and the latest released version.

Please report suspected vulnerabilities privately through GitHub Security Advisories:

https://github.com/sydlexius/canticle/security/advisories/new

Do not open a public issue for security-sensitive reports. Include a clear description, reproduction steps or proof of concept when available, affected versions, and any known mitigations.

Reports are triaged as time permits. Confirmed vulnerabilities will be fixed in main and released with an advisory when appropriate.