Security fixes go into the latest release only. Spooldoc does not patch older releases: a fix ships as a new release, so upgrade to get it.

Please do not report security problems in public issues.

Open a private security advisory on GitHub instead (the "Report a vulnerability" button under the repository's Security tab). Include what you found, how to reproduce it and the version or commit.

What Spooldoc sends to a model, what it stores and how, and what it does on the IBM i are described in docs/security.md.