Security fixes are provided for the latest released version. Before the first release, this policy applies to the main branch.

Do not open public GitHub issues for suspected vulnerabilities.

Report vulnerabilities through Kernel's vulnerability disclosure program, or email security@kernel.sh. GitHub private vulnerability reporting is also fine when it is enabled for this repository. Do not disclose details publicly until you receive a response.