The default branch is the supported line. Older tags are snapshots; they do not receive backports unless a release note says otherwise.

Use GitHub private vulnerability reporting on this repository (Security tab, then Report a vulnerability). Do not open a public issue for a live vulnerability.

I read reports and reply when I can. There is no promised SLA. If I confirm the issue I will say so, patch on a private fork when needed, and credit you if you want that.

Please include: affected version or commit, what you did, what you expected, and a minimal repro.