Only the current main branch receives security fixes.

Please disclose suspected vulnerabilities privately before opening a public issue. Email product@tuval.dev with the affected area, reproduction steps, impact, and any mitigation you have already tested. Do not include real customer data or credentials.

We will acknowledge a report within 72 hours and keep the reporter updated while we investigate. Once a fix is available, we will coordinate disclosure and credit with the reporter unless they prefer to remain anonymous.

When the repository becomes public, GitHub private vulnerability reporting will be enabled as a second private channel.